2040 vulnerabilidades · Windows Orden: CVSS EPSS Año ID
CVE-2021-34523
🔥 KEV Microsoft Exchange Server 2013 Cumulative Update 23 Windows
9.0
CRITICAL
EPSS
94.0%
2021 2 PoCs

Microsoft Exchange Server Elevation of Privilege Vulnerability

Scanner Automatizado
Sin template local disponible
CVE-2025-9501
W3 Total Cache Web Windows
9.0
CRITICAL
EPSS
2.9%
2025 1 PoC

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.

Scanner Automatizado
Sin template local disponible
CVE-2025-3500
Antivirus Windows
9.0
CRITICAL
EPSS
0.0%
2025 CWE-190 1 PoC

Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.

Scanner Automatizado
Sin template local disponible
CVE-2025-8264
z-push/z-push-dev Web Database Windows
9.0
CRITICAL
EPSS
0.1%
2025 CWE-89 1 PoC

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php defi

Scanner Automatizado
Sin template local disponible
CVE-2020-1040
🔥 KEV Windows Server Windows
9.0
CRITICAL
EPSS
0.2%
2020 1 PoC

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.

Scanner Automatizado
Sin template local disponible
CVE-2022-32775
iota All-In-One Security Kit Web Windows
9.0
CRITICAL
EPSS
1.2%
2022 CWE-190 1 PoC

An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Scanner Automatizado
Sin template local disponible
CVE-2014-6332
🔥 KEV Software Genérico Windows
8.8
HIGH
EPSS
94.1%
2014 14 PoCs

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2014-0502
🔥 KEV Software Genérico Windows
8.8
HIGH
EPSS
90.6%
2014 1 PoC

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

Scanner Automatizado
Sin template local disponible
CVE-2013-3893
🔥 KEV Software Genérico Web Windows
8.8
HIGH
EPSS
82.6%
2013 1 PoC

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.

Scanner Automatizado
Sin template local disponible
CVE-2013-3918
🔥 KEV Software Genérico Windows
8.8
HIGH
EPSS
87.0%
2013 1 PoC

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2015-8651
🔥 KEV Software Genérico Windows
8.8
HIGH
EPSS
89.1%
2015 4 PoCs

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

Scanner Automatizado
Sin template local disponible
CVE-2015-2426
🔥 KEV Software Genérico Windows
8.8
HIGH
EPSS
91.8%
2015 2 PoCs

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2015-10144
Thumbnail carousel slider Web Windows
8.8
HIGH
EPSS
0.8%
2015 CWE-434 3 PoCs

The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.

Scanner Automatizado
Sin template local disponible
CVE-2026-20868
Windows 10 Version 1607 Windows
8.8
HIGH
EPSS
0.1%
2026 CWE-122 2 PoCs

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

Scanner Automatizado
Sin template local disponible
CVE-2026-30783
RustDesk Client Web Windows
8.8
HIGH
EPSS
0.1%
2026 CWE-602 1 PoC

A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling. This issue affects RustDesk Client: through 1.4.5.

Scanner Automatizado
Sin template local disponible
CVE-2026-21513
🔥 KEV Windows 10 Version 1607 Windows
8.8
HIGH
EPSS
28.1%
2026 CWE-693 2 PoCs

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Scanner Automatizado
Sin template local disponible
CVE-2023-0603
Sloth Logo Customizer Web Windows
8.8
HIGH
EPSS
8.4%
2023 1 PoC

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Scanner Automatizado
Sin template local disponible
CVE-2023-4827
File Manager Pro Web Windows
8.8
HIGH
EPSS
6.3%
2023 1 PoC

The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.

Scanner Automatizado
Sin template local disponible
CVE-2023-2440
UserPro - Community and User Profile WordPress Plugin Web Windows
8.8
HIGH
EPSS
0.1%
2023 CWE-352 1 PoC

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges to that of any user such as 'administrator' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Scanner Automatizado
Sin template local disponible
CVE-2023-2719
SupportCandy Web Database Windows
8.8
HIGH
EPSS
4.3%
2023 2 PoCs

The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.

Scanner Automatizado
Sin template local disponible