Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
ron jost vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2014-8722
GetSimple CMS 3.3.4 allows remote malicious users to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.
Get-simple Getsimple Cms 3.3.4
8.8
CVSSv3
CVE-2017-9380
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
Open-emr Openemr
7.2
CVSSv3
CVE-2021-24145
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions prior to 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
Webnus Modern Events Calendar Lite
1 Github repository
7.2
CVSSv3
CVE-2021-24155
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin prior to 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Backup-guard Backup Guard
9.8
CVSSv3
CVE-2019-19208
Codiad Web IDE up to and including 2.8.4 allows PHP Code injection.
Codiad Codiad
8.8
CVSSv3
CVE-2018-6383
Monstra CMS up to and including 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a ...
Monstra Monstra
9.8
CVSSv3
CVE-2021-24931
The Secure Copy Content Protection and Content Locking WordPress plugin prior to 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to ...
Ays-pro Secure Copy Content Protection And Content Locking
8.8
CVSSv3
CVE-2021-25076
The WP User Frontend WordPress plugin prior to 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cr...
Wedevs Wp User Frontend
1 Github repository
9.8
CVSSv3
CVE-2021-24946
The Modern Events Calendar Lite WordPress plugin prior to 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Webnus Modern Events Calendar Lite
6.5
CVSSv3
CVE-2017-14537
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
Netfortris Trixbox 2.8.0.4
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-49333
CVE-2024-33901
CVE-2024-36001
CVE-2024-2835
firewall
XPath injection
authentication bypass
CVE-2024-22120
CVE-2024-32002
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »