Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (76 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-24164 1 Ninjaforms 1 Ninja Forms 2024-11-21 4.3 Medium
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
CVE-2021-24163 1 Ninjaforms 1 Ninja Forms 2024-11-21 8.8 High
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
CVE-2020-8594 1 Ninjaforms 1 Ninja Forms 2024-11-21 5.4 Medium
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
CVE-2020-36175 1 Ninjaforms 1 Ninja Forms 2024-11-21 5.3 Medium
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
CVE-2020-36174 1 Ninjaforms 1 Ninja Forms 2024-11-21 6.5 Medium
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
CVE-2020-36173 1 Ninjaforms 1 Ninja Forms 2024-11-21 5.3 Medium
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
CVE-2020-12462 1 Ninjaforms 1 Ninja Forms 2024-11-21 6.1 Medium
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
CVE-2019-15025 1 Ninjaforms 1 Ninjaforms 2024-11-21 N/A
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
CVE-2018-7280 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
CVE-2018-20981 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
CVE-2018-20980 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
CVE-2018-19796 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
CVE-2018-16308 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVE-2017-18574 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
CVE-2024-7354 1 Ninjaforms 1 Ninja Forms 2024-10-04 6.1 Medium
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-43999 1 Ninjaforms 1 Ninja Forms 2024-09-25 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.