Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-37244 3 Ithemes, Supsystic, Wordpress 3 Membership, Membership, Wordpress 2026-07-28 8.2 High
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.
CVE-2020-37243 3 Supsystic, Wordpress, Wpdarko 3 Price Table, Wordpress, Responsive Pricing Table 2026-05-18 8.2 High
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.
CVE-2020-37245 2 Supsystic, Wordpress 2 Digital Publications By Supsystic, Wordpress 2026-05-18 7.5 High
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal sequences. Additionally, the plugin fails to sanitize input fields in publication settings, allowing stored cross-site scripting attacks through script injection in parameters like Area Width and Publication Width that execute when publications are viewed or edited.
CVE-2020-37246 2 Supsystic, Wordpress 2 Backup, Wordpress 2026-05-18 6.2 Medium
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.
CVE-2020-37242 2 Supsystic, Wordpress 2 Ultimate Maps, Wordpress 2026-05-18 8.2 High
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET parameter. Attackers can send crafted requests to the getListForTbl action with boolean-based blind or time-based blind SQL injection payloads to extract sensitive database information.
CVE-2017-20065 1 Supsystic 1 Popup 2025-04-15 4.3 Medium
A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2021-24276 1 Supsystic 1 Contact Form 2024-11-21 6.1 Medium
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVE-2021-24275 1 Supsystic 1 Popup 2024-11-21 6.1 Medium
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVE-2021-24274 1 Supsystic 1 Ultimate Maps 2024-11-21 6.1 Medium
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVE-2020-9394 1 Supsystic 1 Pricing Table By Supsystic 2024-11-21 8.8 High
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
CVE-2020-9393 1 Supsystic 1 Pricing Table By Supsystic 2024-11-21 6.1 Medium
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
CVE-2020-9392 1 Supsystic 1 Pricing Table By Supsystic 2024-11-21 7.3 High
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.
CVE-2020-12076 1 Supsystic 1 Data Tables Generator 2024-11-21 8.8 High
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.
CVE-2020-12075 1 Supsystic 1 Data Tables Generator 2024-11-21 8.8 High
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
CVE-2017-18512 1 Supsystic 1 Newsletter By Supsystic 2024-11-21 N/A
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
CVE-2016-10918 1 Supsystic 1 Photo Gallery 2024-11-21 N/A
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
CVE-2016-10915 1 Supsystic 1 Popup 2024-11-21 N/A
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.