Vulnerabilities
Summary — last 7 days
New vulnerabilities4,782▲ 1,730 vs. last week
Critical / high2,632▲ 1,098 vs. last week
New active exploitation (KEV)7▲ 2 vs. last week
Unscored (no CVSS)206▲ 36 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | High (7.2) | 4.6% | — | Solvercircle WP Icommerce | 9/20/2021 | 6/17/2026 | The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors | |
| Modified | Medium (4.3) | 1.7% | 💥 Exploit | GTP Icommerce | 1/18/2006 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |