CVE Database and Vulnerability Search - Exploit Intel

Skip to content

Vulnerabilities: 381,276
with PoCs: 37,250
CISA KEV: 1,665
Ransomware: 606
with Nuclei: 4,342

Vulnerability search results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-10402HIGH	Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms. CWE-862Oct 26, 2024	CVSS7.5v3.1	EPSS0.509%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-7389HIGH	Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration. CWE-522Aug 2, 2024	CVSS7.5v3.1	EPSS0.658%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-31077HIGH	Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition. CWE-89Apr 23, 2024	CVSS7.2v3.1	EPSS30.4%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-31857MEDIUM	Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser. CWE-79Apr 23, 2024	CVSS5.4v3.1	EPSS0.632%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29777HIGH	WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator.This issue affects Forminator: from n/a through <= 1.29.0. CWE-79Mar 27, 2024	CVSS7.1v3.1	EPSS0.426%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-4596CRITICAL	Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CWE-434Aug 30, 20231 related artifact	CVSS9.8v3.1	EPSS12.7%	PoCs4	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2021-36821HIGH	WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11. CWE-79Mar 16, 2023	CVSS7.1v3.1	EPSS0.406%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX