CVE Database
Synced from NVD, cross-referenced against CISA KEV and EPSS · ordered by last update
| CVE ID | Score | Description |
|---|---|---|
| Exploit 12d ago | 9.6 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution. |
| 12d ago | 5.9 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. |
| 12d ago | 7.1 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. |
| 12d ago | 7.1 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. |
| 12d ago | 5.9 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. |
| 12d ago | 4.3 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. |
| 12d ago | 6.5 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. |
| 12d ago | 4.3 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. |
| 12d ago | 5.9 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. |
| 12d ago | 7.6 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. |
| 12d ago | 4.8 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. |
| 12d ago | 4.3 | Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. |
| 12d ago | 5.3 | Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. |
| 12d ago | 8.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1. |
| 12d ago | 5.3 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. |
| 12d ago | 4.3 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
| 12d ago | 5.3 | Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. |
| 12d ago | 6.5 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. |
| 12d ago | 7.2 | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| 12d ago | 6.5 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. |
| 12d ago | 5.4 | Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4. |
| 12d ago | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
| 12d ago | 7.1 | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| 12d ago | 5.3 | Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. |
| 12d ago | 5.3 | Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |