Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Registration & Login with Mobile Phone Number for WooCommerce | CVE-2025-69052 Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for… |
9,8 | 0,39 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Miion | CVE-2025-68986 Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through <= 1.2.7. |
9,9 | 0,52 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Blogistic | CVE-2025-68909 Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: from n/a through <= 1.0.5. |
9,9 | 0,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Blogzee | CVE-2025-68910 Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through <= 1.0.5. |
9,9 | 0,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| LazyTasks | CVE-2025-68869 Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37. |
9,8 | 0,47 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Paid Downloads | CVE-2025-68857 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through <= 3.15. |
9,3 | 0,34 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Order Listener for WooCommerce | CVE-2025-68018 Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1. |
9,4 | 0,36 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| CleverReach® WP | CVE-2025-68034 Wstrzyknięcie SQL w CleverReach® WP umożliwia atakującym manipulację bazą danych. |
9,3 | 0,48 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Event Tickets with Ticket Scanner | CVE-2025-68015 Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5. |
9,0 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Real Homes CRM | CVE-2025-67968 Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0. |
9,9 | 0,57 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| g-FFL Checkout | CVE-2025-68001 Nieograniczony upload niebezpiecznych plików w g-FFL Checkout umożliwia wgranie powłoki sieciowej. |
10,0 | 0,65 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Nelio AB Testing | CVE-2025-67944 Wstrzyknięcie kodu w Nelio AB Testing umożliwia zdalne wykonanie nieautoryzowanego kodu. |
9,1 | 0,58 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| MailerLite – WooCommerce integration | CVE-2025-67945 Wstrzyknięcie SQL w integracji MailerLite z WooCommerce umożliwia atakującym manipulację danymi. |
9,3 | 0,44 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Consult Aid | CVE-2025-67617 Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3. |
9,8 | 0,8 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Blogmatic | CVE-2025-62050 Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3. |
9,9 | 0,54 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| News Event | CVE-2025-62056 Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes News Event news-event.This issue affects News Event: from n/a through <= 1.0.1. |
9,9 | 0,54 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Energia | CVE-2025-50002 Nieograniczony upload niebezpiecznych plików w Farost Energia umożliwia wgranie powłoki sieciowej. |
10,0 | 0,63 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| WP Lead Capturing Pages | CVE-2025-49055 Wstrzyknięcie SQL w WP Lead Capturing Pages umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
9,3 | 0,44 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| docling-core | CVE-2026-24009 Wykorzystanie niezaufanych danych YAML w docling-core pozwala na zdalne wykonanie kodu. |
9,8 | 1,53 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| NR1800X | CVE-2026-1326 A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated… |
8,8 | 3,49 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| NR1800X | CVE-2026-1327 A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be… |
8,8 | 2,87 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| nerves_hub_web | CVE-2025-64097 NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued… |
9,8 | 0,47 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| MeetingHub | CVE-2026-1331 MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. |
9,3 | 0,75 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| LA-Studio Element Kit for Elementor | CVE-2026-0920 The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for… |
9,8 | 1,11 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| appsmith | CVE-2026-24042 Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the… |
9,8 | 0,64 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.