Vulnerabilities
Summary — last 7 days
New vulnerabilities4,591▼ 563 vs. last week
Critical / high1,803▼ 1,118 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)880▲ 782 vs. last week
More filters
13 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Medium (6.1) | 3.7% | Exploit | Hitmyserver HMS Testimonials | 1/30/2020 | 6/16/2026 | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format… | |
| Modified | High (7.5) | 2.0% | — | Myserver.alexcthomas18 Project Myserver.alexcthomas18 | 6/7/2018 | 6/17/2026 | myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. | |
| Modified | Medium (6.8) | 2.8% | Exploit | Hitmyserver HMS Testimonials | 4/2/2014 | 6/16/2026 | Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add new groups via the… | |
| Modified | Medium (5) | 3.5% | Exploit | Myserver | 11/18/2008 | 6/16/2026 | Unspecified vulnerability in MyServer 0.8.11 allows remote attackers to cause a denial of service (daemon crash) via multiple invalid requests with the HTTP GET, DELETE, OPTIONS, and possibly other methods, related to a "204 No Content error." | |
| Modified | Medium (4.3) | 4.2% | Exploit | Myserver | 6/22/2007 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in the cgi-bin/post.mscgi sample page in MyServer 0.8.9 allows remote attackers to inject arbitrary web script or HTML via the body content. | |
| Modified | High (7.5) | 6.0% | Exploit | Myserverproject Myserver | 6/22/2007 | 6/16/2026 | MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code) via a modified extension, as demonstrated by post.mscgI. | |
| Modified | High (7.8) | 2.9% | — | Myserver | 5/1/2007 | 6/16/2026 | MyServer before 0.8.8 allows remote attackers to cause a denial of service via unspecified vectors. | |
| Modified | High (7.5) | 1.4% | — | Myserver | 3/21/2007 | 6/16/2026 | server.cpp in MyServer 0.8.5 calls Process::setuid before calling Process::setgid and thus does not properly drop privileges, which might allow remote attackers to execute CGI programs with unintended privileges. | |
| Modified | Medium (5) | 1.5% | — | Myserver | 5/18/2005 | 6/16/2026 | Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..." (triple dot). | |
| Modified | Medium (4.3) | 1.0% | — | MyserverAI | 5/18/2005 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..." (triple dot) followed by an onmouseover event. | |
| Modified | Medium (5) | 3.6% | Exploit | Myserver | 12/31/2004 | 6/16/2026 | myServer 0.7.1 allows remote attackers to cause a denial of service (crash) via a long HTTP POST request in a View=Logon operation to index.html. | |
| Modified | Medium (5) | 8.4% | Exploit | Myserver | 12/31/2004 | 6/16/2026 | Directory traversal vulnerability in myServer 0.7 allows remote attackers to list arbitrary directories via an HTTP GET command with a large number of "./" sequences followed by "../" sequences. | |
| Modified | Medium (5) | 1.6% | — | Myserver | 12/31/2002 | 6/16/2026 | Directory traversal vulnerability in MyServer 0.11 and 0.2 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP GET request. |