Total
425358 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4317 | 1 Gitlab | 1 Dynamic Application Security Testing Analyzer | 2026-06-17 | N/A | 5.0 MEDIUM |
| An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects. | |||||
| CVE-2022-4315 | 1 Gitlab | 1 Dynamic Application Security Testing Analyzer | 2026-06-17 | N/A | 5.0 MEDIUM |
| An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page. | |||||
| CVE-2022-4314 | 1 Ikus-soft | 1 Rdiffweb | 2026-06-17 | N/A | 9.8 CRITICAL |
| Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2. | |||||
| CVE-2022-4313 | 1 Tenable | 2 Nessus, Plugin Feed | 2026-06-17 | N/A | 8.8 HIGH |
| A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets. | |||||
| CVE-2022-4310 | 1 Wp-slimstat | 1 Slimstat Analytics | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs | |||||
| CVE-2022-4309 | 1 Subscribe2 Project | 1 Subscribe2 | 2026-06-17 | N/A | 3.1 LOW |
| The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack. | |||||
| CVE-2022-4308 | 1 Secomea | 1 Gatemanager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. | |||||
| CVE-2022-4307 | 1 Wp-master | 1 Pardakht-delkhah | 2026-06-17 | N/A | 6.1 MEDIUM |
| The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin. | |||||
| CVE-2022-4306 | 1 Panda Pods Repeater Field Project | 1 Panda Pods Repeater Field | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission. | |||||
| CVE-2022-4305 | 1 Wp-buy | 1 Login As User Or Customer \(user Switching\) | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. | |||||
| CVE-2022-4303 | 1 Ciphercoin | 1 Wp Limit Login Attempts | 2026-06-17 | N/A | 7.5 HIGH |
| The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms. | |||||
| CVE-2022-4302 | 1 Videousermanuals | 1 White Label Cms | 2026-06-17 | N/A | 7.2 HIGH |
| The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||
| CVE-2022-4301 | 1 Sunshinephotocart | 1 Sunshine Photo Cart | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. | |||||
| CVE-2022-4300 | 1 Xjd2020 | 1 Fastcms | 2026-06-17 | N/A | 6.3 MEDIUM |
| A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability. | |||||
| CVE-2022-4299 | 1 Metricool | 1 Metricool | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-4298 | 1 Cedcommerce | 1 Wholesale Market | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. | |||||
| CVE-2022-4297 | 1 Netflixtech | 1 Wp Autocomplete Search | 2026-06-17 | N/A | 9.8 CRITICAL |
| The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection | |||||
| CVE-2022-4296 | 1 Tp-link | 2 Tl-wr740n, Tl-wr740n Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation leads to resource consumption. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214812. | |||||
| CVE-2022-4295 | 1 Appjetty | 1 Show All Comments | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. | |||||
| CVE-2022-4294 | 5 Avast, Avg, Avira and 2 more | 5 Antivirus, Antivirus, Avira Security and 2 more | 2026-06-17 | N/A | 7.1 HIGH |
| Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. | |||||