https://vulnogram.org/ Most recent CVEs assigned by AppCheck Ltd. (appcheck). https://vulnogram.org/seaview/icons/appcheck.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2024-29833 https://vulnogram.org/CVE-2024-29833 The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace… Medium Tue, 26 Mar 2024 15:30:28 GMT https://vulnogram.org/CVE-2024-29810 https://vulnogram.org/CVE-2024-29810 The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitr… Medium Tue, 26 Mar 2024 15:28:58 GMT https://vulnogram.org/CVE-2024-29809 https://vulnogram.org/CVE-2024-29809 The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitr… Medium Tue, 26 Mar 2024 15:27:56 GMT https://vulnogram.org/CVE-2024-29808 https://vulnogram.org/CVE-2024-29808 The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrar… Medium Tue, 26 Mar 2024 15:26:34 GMT https://vulnogram.org/CVE-2024-29832 https://vulnogram.org/CVE-2024-29832 The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbit… Medium Tue, 26 Mar 2024 15:24:24 GMT https://vulnogram.org/CVE-2023-41137 https://vulnogram.org/CVE-2023-41137 Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server. High Thu, 09 Nov 2023 15:07:51 GMT https://vulnogram.org/CVE-2023-41138 https://vulnogram.org/CVE-2023-41138 The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process. High Thu, 09 Nov 2023 15:05:24 GMT https://vulnogram.org/CVE-2021-40186 https://vulnogram.org/CVE-2021-40186 The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their… Medium Tue, 31 May 2022 18:09:43 GMT https://vulnogram.org/CVE-2022-22690 https://vulnogram.org/CVE-2022-22690 Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the applicat… High Network Exploitable Tue, 18 Jan 2022 16:52:21 GMT https://vulnogram.org/CVE-2022-22691 https://vulnogram.org/CVE-2022-22691 The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers… Medium Network Exploitable Tue, 18 Jan 2022 16:52:20 GMT https://vulnogram.org/CVE-2021-43991 https://vulnogram.org/CVE-2021-43991 The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client… Medium Fri, 03 Dec 2021 14:42:31 GMT https://vulnogram.org/CVE-2021-43408 https://vulnogram.org/CVE-2021-43408 The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited… Medium Fri, 19 Nov 2021 15:41:32 GMT https://vulnogram.org/CVE-2021-43409 https://vulnogram.org/CVE-2021-43409 The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the ap… Critical Network Exploitable Fri, 19 Nov 2021 15:39:00 GMT