Total
425359 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4061 | 1 Ultimatemember | 1 Jobboardwp | 2026-06-17 | N/A | 7.5 HIGH |
| The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP. | |||||
| CVE-2022-4060 | 1 Odude | 1 User Post Gallery | 2026-06-17 | N/A | 9.8 CRITICAL |
| The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it. | |||||
| CVE-2022-4059 | 1 Blocksera | 1 Cryptocurrency Widgets Pack | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |||||
| CVE-2022-4058 | 1 10web | 1 Photo Gallery | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control. | |||||
| CVE-2022-4057 | 1 Optimizingmatters | 1 Autooptimize | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. | |||||
| CVE-2022-4055 | 1 Freedesktop | 1 Xdg-utils | 2026-06-17 | N/A | 7.4 HIGH |
| When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked. | |||||
| CVE-2022-4054 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 5.5 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers. | |||||
| CVE-2022-4053 | 1 Student Attendance Management System Project | 1 Student Attendance Management System | 2026-06-17 | N/A | 2.4 LOW |
| A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213846 is the identifier assigned to this vulnerability. | |||||
| CVE-2022-4052 | 1 Student Attendance Management System Project | 1 Student Attendance Management System | 2026-06-17 | N/A | 4.7 MEDIUM |
| A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213845 was assigned to this vulnerability. | |||||
| CVE-2022-4051 | 1 Hostel Searching Project | 1 Hostel Searching Project | 2026-06-17 | N/A | 6.3 MEDIUM |
| A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213844. | |||||
| CVE-2022-4050 | 1 Beardev | 1 Joomsport | 2026-06-17 | N/A | 9.8 CRITICAL |
| The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users | |||||
| CVE-2022-4049 | 1 Wp User Project | 1 Wp User | 2026-06-17 | N/A | 9.8 CRITICAL |
| The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. | |||||
| CVE-2022-4048 | 1 Codesys | 1 Development System V3 | 2026-06-17 | N/A | 7.7 HIGH |
| Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application. | |||||
| CVE-2022-4047 | 1 Wpswings | 1 Return Refund And Exchange For Woocommerce | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE | |||||
| CVE-2022-4046 | 1 Codesys | 14 Control For Beaglebone Sl, Control For Empc-a\/imx6 Sl, Control For Iot2000 Sl and 11 more | 2026-06-17 | N/A | 8.8 HIGH |
| In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device. | |||||
| CVE-2022-4045 | 1 Mattermost | 1 Mattermost | 2026-06-17 | N/A | 3.1 LOW |
| A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. | |||||
| CVE-2022-4044 | 1 Mattermost | 1 Mattermost | 2026-06-17 | N/A | 4.3 MEDIUM |
| A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. | |||||
| CVE-2022-4043 | 1 Wp Custom Admin Interface Project | 1 Wp Custom Admin Interface | 2026-06-17 | N/A | 7.2 HIGH |
| The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||
| CVE-2022-4042 | 1 Paytium | 1 Paytium | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-4041 | 1 Hitachi | 1 Storage Plug-in | 2026-06-17 | N/A | 5.9 MEDIUM |
| Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1. | |||||