High 7.8 KEV
CVE-2023-38831 · 2026-09-02 · pending_review
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
Vulnerability list
Filter public vulnerability entries by severity / channel / vendor / time.
Critical 9.8 KEV
CVE-2022-47966 · 2026-09-03 · pending_review
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
High 7.8 KEV
CVE-2018-20250 · 2026-09-04 · pending_review
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
High 8.1 KEV
CVE-2017-12617 · 2026-09-03 · pending_review
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
High 8.2
CVE-2017-20266 · 2026-08-19 · auto
Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the searchword parameter. Attackers can send…
Critical 9.8
CVE-2015-10138 · 2026-07-27 · auto
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2…
Critical 9.8
CVE-2017-20251 · 2026-07-21 · draft
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress RES…
High 8.2
CVE-2017-20247 · 2026-07-21 · draft
WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can …
High 8.2
CVE-2017-20246 · 2026-07-21 · draft
KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code throug…
High 8.2
CVE-2017-20245 · 2026-07-21 · draft
Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped 'idsignup' POST parameter. Attackers can se…
High 8.2
CVE-2017-20244 · 2026-07-21 · draft
Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject …
High 8.2
CVE-2017-20243 · 2026-07-21 · draft
WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id pa…
High 8.2
CVE-2016-20065 · 2026-07-21 · draft
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter…
High 8.2
CVE-2016-20062 · 2026-07-21 · draft
Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the 'pollid' POST parameter. Attackers ca…