Larry Cashdollar — recent CVEs

CVE-2026-22755 · 9.3 CRITICAL 🌩️ — Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi

Tue, 13 Jan 2026 15:12:53 GMT

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9…

CVE-2025-12592 · 9.3 CRITICAL 🌩️ — Use of default login credentials in Legacy Vivotek Devices

Wed, 19 Nov 2025 12:30:32 GMT

Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.

CVE-2022-40721

Mon, 03 Oct 2022 14:53:48 GMT

Arbitrary file upload vulnerability in php uploader

CVE-2020-8521

Tue, 07 Jul 2020 19:20:21 GMT

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql

CVE-2020-8520

Tue, 07 Jul 2020 19:20:20 GMT

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql

CVE-2020-8519

Tue, 07 Jul 2020 19:20:20 GMT

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql

CVE-2019-8293

Mon, 23 Dec 2019 21:45:08 GMT

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.

CVE-2019-8292

Tue, 01 Oct 2019 19:53:28 GMT

Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion.

CVE-2019-8291

Tue, 01 Oct 2019 19:53:28 GMT

Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.

CVE-2019-8290

Tue, 01 Oct 2019 19:53:28 GMT

Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php allowing special characters to be included and an XSS payload to be injected.

CVE-2019-8289

Tue, 01 Oct 2019 19:53:28 GMT

Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable

CVE-2019-8288

Tue, 01 Oct 2019 19:53:28 GMT

Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.

CVE-2015-4617

Fri, 15 Feb 2019 21:00:00 GMT

Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.

CVE-2015-4615

Fri, 15 Feb 2019 21:00:00 GMT

Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables

CVE-2013-5654

Fri, 15 Feb 2019 21:00:00 GMT

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage

CVE-2013-2565

Fri, 15 Feb 2019 21:00:00 GMT

A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.

CVE-2013-2516

Fri, 15 Feb 2019 21:00:00 GMT

Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.

CVE-2018-1002009

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email…

CVE-2018-1002008

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variabl…

CVE-2018-1002007

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST reque…

CVE-2018-1002006

Mon, 03 Dec 2018 16:00:00 GMT

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes

CVE-2018-1002005

Mon, 03 Dec 2018 16:00:00 GMT

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.

CVE-2018-1002004

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

CVE-2018-1002003

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

CVE-2018-1002002

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

CVE-2018-1002001

Mon, 03 Dec 2018 16:00:00 GMT

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

CVE-2018-1002000

Mon, 03 Dec 2018 16:00:00 GMT

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST req…

CVE-2018-9209

Mon, 19 Nov 2018 18:00:00 GMT

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

CVE-2018-9207

Mon, 19 Nov 2018 17:00:00 GMT

Arbitrary file upload in jQuery Upload File <= 4.0.2

CVE-2018-9208

Mon, 05 Nov 2018 14:00:00 GMT

Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta

CVE-2018-9206

Thu, 11 Oct 2018 15:00:00 GMT

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

CVE-2018-9205

Wed, 04 Apr 2018 15:00:00 GMT

Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.

CVE-2017-2551

Wed, 27 Sep 2017 16:00:00 GMT

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

CVE-2017-1002028

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

CVE-2017-1002027

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.

CVE-2017-1002026

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

CVE-2017-1002025

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.

CVE-2017-1002024

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files.

CVE-2017-1002023

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

CVE-2017-1002022

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

CVE-2017-1002021

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.

CVE-2017-1002020

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.

CVE-2017-1002019

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

CVE-2017-1002018

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

CVE-2017-1002017

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.

CVE-2017-1002016

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.

CVE-2017-1002015

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.

CVE-2017-1002014

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.

CVE-2017-1002013

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.

CVE-2017-1002012

Thu, 14 Sep 2017 13:00:00 GMT

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.