The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total56,776
Mitigations19,218
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
ARForms<= 7.2.4
Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability
8.1
9 minutes ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability
7.1
9 minutes ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability
7.1
10 minutes ago
mongoose< 6.13.11
npm: Mongoose: sanitizeFilter not applied on countDocuments
9.8
17 minutes ago
@nocobase/plugin-action-custom-request>= 2.1.0-alpha.8, < 2.1.15
npm: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
4.3
34 minutes ago
WPIDE – File Manager & Code Editor<= 3.6.4
Cross Site Request Forgery (CSRF) vulnerability
8.8
3 hours ago
@ohif/extension-dicom-pdf>= 3.5.0-beta.0, < 3.12.18
npm: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
8.8
3 hours ago
node-forge<= 1.4.0
npm: Forge: Certificate signature verified with the issuer's RSA signature scheme
3.7
3 hours ago
node-forge<= 1.4.0
npm: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
3.7
3 hours ago
node-forge<= 1.4.0
npm: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
5.9
3 hours ago
node-forge<= 1.4.0
npm: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
3 hours ago
node-forge<= 1.4.0
npm: Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
7.5
3 hours ago
effect>= 4.0.0-beta.0, < 4.0.0-beta.103
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
3 hours ago
@effect/platform>= 0.1.0, < 0.97.1
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
3 hours ago
altair-fastify-plugin>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
3 hours ago
altair-koa-middleware>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
3 hours ago
altair-express-middleware>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
3 hours ago
altair-static>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
3 hours ago
bitcoinjs-lib>= 2.3.0, < 5.2.1
npm: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
9.3
3 hours ago
@nuxt/content>= 3.0.0, < 3.15.2
npm: Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
7.5
3 hours ago