Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2537▼ 356 respecto a la semana anterior
Críticas / altas1341▲ 75 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
3 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 1.2% | — | Brandsdistribution Bdroppy | 24/4/2023 | 17/6/2026 | SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component. | |
| Modificada | Media (6.5) | 1.6% | — | Droppy Project Droppy | 2/11/2020 | 17/6/2026 | This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server. | |
| Modificada | Alta (8.8) | 0.49% | — | Droppy Project Droppy | 31/5/2018 | 17/6/2026 | Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete… |