HIGH
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
Vulnerability intelligence
Tracked vulnerabilities
Published CVEs with severity, CVSS, affected vendors and products, exploitation status, remediation deadlines, and primary sources.
Matching records854
KEV additions · 7 days9
KEV additions · 30 days32
KEV due within 30 days0
MEDIUM
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
CRITICAL
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
MEDIUM
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
HIGH
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
HIGH
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
CRITICAL
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
HIGH
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
HIGH
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep out of reach. This issue affects Apache APISIX: from 2.11.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
HIGH
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
HIGH
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
MEDIUM
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.