newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-14 18:11Z
Subscribe to news →
CVE-2023-35175 — Hp W1a75a_firmware: Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model. CVSSv3.1 9.8 (CRITICAL) · EPSS 76th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-3249 — Miniorange Web3_-_crypto_wallet_login_\&_nft_token_gating: The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3063 — Smartypantsplugins Sp_project_\&_document_manager: The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct
The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber privileges or above, to change user passwords and potentially take over administrator accounts. CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-2834 — Stylemixthemes Bookit: The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. CVSSv3.1 9.8 (CRITICAL) · EPSS 64th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-36143 — Maxprintisp Maxlink_1200g_firmware: Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool"
Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2023-2982 — Miniorange Wordpress_social_login_and_register_\(discord\,_google\,_twitter: The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was p CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-3388 — Beautiful-cookie-banner Beautiful_cookie_consent_banner: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2. CVSSv3.1 7.2 (HIGH) · EPSS 99th percentile
7.2
CVSS v3.1
100
Edit Score
CVE-2023-3197 — Inspireui Mstore_api: The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-34672 — Elenos Etg150_firmware: Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter
Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-34671 — Elenos Etg150_fm_firmware: Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on
Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2019-25152 — Tychesoftwares Abandoned_cart_lite_for_woocommerce: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile
7.2
CVSS v3.1
94
Edit Score
CVE-2022-45287 — Temenos Cwx: An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to
An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands. CVSSv3.1 8.8 (HIGH) · EPSS 64th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-3325 — Cmscommander Cms_commander: The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escala CVSSv3.1 8.1 (HIGH) · EPSS 30th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2023-2907 — Marksoft Marksoft: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection.This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-34832 — Tp-link Archer_ax10_firmware: Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8
TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-34752 — Bloofox Bloofoxcms: v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-34944 — Chamilo Chamilo_lms: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-31541 — Ckeditor Ckeditor: A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-35064 — Satos Satos_mobile: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3050 — Tmtmakine Lockcell_firmware: Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3049 — Tmtmakine Lockcell_firmware: Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This
Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3048 — Tmtmakine Lockcell_firmware: Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This
Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3047 — Tmtmakine Lockcell_firmware: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-2278 — Wpdirectorykit Wp_directory_kit: The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-2249 — Gvectors Wpforo_forum: The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perfor CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score