Vulnerabilities
Summary — last 7 days
New vulnerabilities5,337▲ 2,481 vs. last week
Critical / high3,000▲ 1,638 vs. last week
New active exploitation (KEV)7▼ 1 vs. last week
Unscored (no CVSS)186▼ 4 vs. last week
35 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | High (10) | 5.3% | — | Smartertools Smarterstats | 5/20/2011 | 6/16/2026 | Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the… | |
| Modified | Medium (4.3) | 1.5% | 💥 Exploit | Smartertools Smarterstats | 9/16/2010 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter. | |
| Modified | Medium (5) | 14% | 💥 Exploit | Joomlamo COM Userstatus | 4/8/2010 | 6/16/2026 | Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. | |
| Modified | High (9.3) | 11% | 💥 Exploit | Dvrstation CMS | 10/14/2008 | 6/16/2026 | Heap-based buffer overflow in the PdvrAtl.PdvrOcx.1 ActiveX control (pdvratl.dll) in DVRHOST Web CMS OCX 1.0.1.25 allows remote attackers to execute arbitrary code via a long second argument to the TimeSpanFormat method. | |
| Modified | Medium (4.3) | 0.87% | — | Xoops Xm-memberstats | 2/28/2008 | 6/16/2026 | Cross-site scripting (XSS) vulnerability index.php in the XM-Memberstats (xmmemberstats) module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the sortby parameter. | |
| Modified | High (7.5) | 1.1% | — | Xoops XM Memberstats | 2/28/2008 | 6/16/2026 | Multiple SQL injection vulnerabilities in index.php in the XM-Memberstats (xmmemberstats) 2.0e module for XOOPS allow remote attackers to execute arbitrary SQL commands via the (1) letter or (2) sortby parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party… | |
| Modified | Medium (4.3) | 0.66% | — | Buffalotech Airstation Whr-g54s | 9/11/2007 | 6/16/2026 | Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by… | |
| Modified | Medium (6.8) | 6.9% | 💥 Exploit | Mamboxchange Serverstat Component | 9/19/2006 | 6/16/2026 | PHP remote file inclusion vulnerability in install.serverstat.php in the Serverstat (com_serverstat) 0.4.4 and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. | |
| Modified | High (7.5) | 2.5% | — | Softwolves Software Turquoise Superstat | 9/15/2005 | 6/16/2026 | Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month. | |
| Modified | Low (0) | 1.3% | — | SUN RstatdAISUN RstatAI | 1/1/1999 | 6/16/2026 | The rstat/rstatd service is running. |