newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-14 19:49Z
Subscribe to news →
CVE-2023-34672 — Elenos Etg150_firmware: Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter
Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-34671 — Elenos Etg150_fm_firmware: Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on
Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2019-25152 — Tychesoftwares Abandoned_cart_lite_for_woocommerce: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile
7.2
CVSS v3.1
94
Edit Score
CVE-2022-45287 — Temenos Cwx: An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to
An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands. CVSSv3.1 8.8 (HIGH) · EPSS 64th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-3325 — Cmscommander Cms_commander: The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escala CVSSv3.1 8.1 (HIGH) · EPSS 30th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2023-2907 — Marksoft Marksoft: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection.This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-34832 — Tp-link Archer_ax10_firmware: Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8
TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-34752 — Bloofox Bloofoxcms: v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-34944 — Chamilo Chamilo_lms: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-31541 — Ckeditor Ckeditor: A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-35064 — Satos Satos_mobile: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3050 — Tmtmakine Lockcell_firmware: Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3049 — Tmtmakine Lockcell_firmware: Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This
Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3048 — Tmtmakine Lockcell_firmware: Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This
Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-3047 — Tmtmakine Lockcell_firmware: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2023-2278 — Wpdirectorykit Wp_directory_kit: The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-2249 — Gvectors Wpforo_forum: The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perfor CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2023-2237 — Yudiz Wp_replicate_post: The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the
The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor-level attackers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-1895 — Motopress Getwid: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVSSv3.1 8.5 (HIGH) · EPSS 42th percentile
8.5
CVSS v3.1
93
Edit Score
CVE-2023-1888 — Wpwax Directorist: The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.g., administrator) privileges. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-0992 — Getshieldsecurity Shield_security: The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile
7.2
CVSS v3.1
98
Edit Score
CVE-2023-0721 — Wpmet Metform_elementor_contact_form_builder: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. CVSSv3.1 8.3 (HIGH) · EPSS 75th percentile
8.3
CVSS v3.1
92
Edit Score
CVE-2023-2986 — Tychesoftwares Abandoned_cart_lite_for_woocommerce: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulner CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-4380 — Valvepress Pinterest_automatic_pin: The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-4337 — Xforwoocommerce Add_product_tabs: Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2 CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile
8.8
CVSS v3.1
94
Edit Score