CVE-2016-20097 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbit… |
CVE-2016-20096 | Critical | 9.8 | 2026-07-21 | Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQ… |
CVE-2016-20095 | High | 7.8 | 2026-06-19 | Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that a… |
CVE-2016-20094 | High | 7.8 | 2026-06-19 | AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the servic… |
CVE-2016-20093 | High | 7.8 | 2026-06-19 | Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allo… |
CVE-2016-20092 | High | 7.8 | 2026-06-19 | NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code wi… |
CVE-2016-20091 | High | 7.8 | 2026-06-19 | Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious exec… |
CVE-2016-20090 | High | 7.8 | 2026-06-19 | Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path run… |
CVE-2016-20089 | High | 7.8 | 2026-06-19 | Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the… |
CVE-2016-20088 | High | 7.8 | 2026-06-19 | Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local a… |
CVE-2016-20087 | High | 7.8 | 2026-06-19 | Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting… |
CVE-2016-20086 | High | 7.8 | 2026-06-19 | Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to esca… |
CVE-2016-20085 | High | 7.8 | 2026-06-19 | Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a… |
CVE-2016-20084 | High | 7.2 | 2026-06-15 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar se… |
CVE-2016-20083 | Medium | 5.3 | 2026-06-15 | WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF to… |
CVE-2016-20082 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the acti… |
CVE-2016-20081 | High | 7.5 | 2026-06-15 | WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manip… |
CVE-2016-20080 | Medium | 6.2 | 2026-06-15 | WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to inc… |
CVE-2016-20079 | Medium | 6.2 | 2026-06-15 | WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by m… |
CVE-2016-20078 | Medium | 6.2 | 2026-06-15 | WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating… |
CVE-2016-20077 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting i… |
CVE-2016-20076 | High | 7.5 | 2026-06-15 | WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by… |
CVE-2016-20075 | High | 8.8 | 2026-06-15 | WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or a… |
CVE-2016-20074 | Medium | 4.3 | 2026-06-15 | WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting… |
CVE-2016-20073 | High | 8.2 | 2026-06-15 | Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2016-20072 | High | 8.2 | 2026-06-15 | BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20071 | High | 8.2 | 2026-06-15 | The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2016-20070 | Medium | 6.4 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to… |
CVE-2016-20069 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize t… |
CVE-2016-20068 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2016-20067 | Medium | 4.3 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated u… |
CVE-2016-20066 | High | 7.2 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file up… |
CVE-2016-20065 | High | 8.2 | 2026-06-09 | Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20064 | Medium | 6.2 | 2026-06-09 | WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped paramet… |
CVE-2016-20063 | High | 7.1 | 2026-06-09 | Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious c… |
CVE-2016-20062 | High | 8.2 | 2026-06-09 | Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecti… |
CVE-2016-20054 | Medium | 4.3 | 2026-04-04 | Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. At… |
CVE-2016-20061 | High | 7.8 | 2026-04-04 | sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers to escalate privileges by exploiting th… |
CVE-2016-20060 | High | 7.8 | 2026-04-04 | Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attackers to escalate privileges by injectin… |
CVE-2016-20059 | High | 7.8 | 2026-04-04 | IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalat… |
CVE-2016-20058 | High | 7.8 | 2026-04-04 | Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local at… |
CVE-2016-20057 | High | 7.8 | 2026-04-04 | NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate priv… |
CVE-2016-20056 | High | 7.8 | 2026-04-04 | Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escala… |
CVE-2016-20055 | High | 7.8 | 2026-04-04 | IObit Advanced SystemCare 10.0.2 contains an unquoted service path vulnerability in the AdvancedSystemCareService10 service that allows local attackers to esca… |
CVE-2016-20053 | Medium | 5.3 | 2026-04-04 | Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking aut… |
CVE-2016-20052 | Critical | 9.8 | 2026-04-04 | Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to t… |
CVE-2016-20051 | Medium | 5.3 | 2026-04-04 | Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting… |
CVE-2016-20050 | Medium | 6.2 | 2026-04-04 | NetSchedScan 1.0 contains a buffer overflow vulnerability in the scan Hostname/IP field that allows local attackers to crash the application by supplying an ov… |
CVE-2016-15058 | High | 8.1 | 2026-04-03 | Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure… |
CVE-2016-20049 | Critical | 9.8 | 2026-03-28 | JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying oversized input t… |
CVE-2016-20048 | High | 8.4 | 2026-03-28 | iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized value to the… |
CVE-2016-20047 | High | 8.4 | 2026-03-28 | EKG Gadu 1.9~pre+r2855-3+b1 contains a local buffer overflow vulnerability in the username handling that allows local attackers to execute arbitrary code by su… |
CVE-2016-20046 | High | 8.4 | 2026-03-28 | zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of FTP connections that allows local attackers to crash… |
CVE-2016-20045 | High | 8.4 | 2026-03-28 | HNB Organizer 1.9.18-10 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument… |
CVE-2016-20044 | High | 8.4 | 2026-03-28 | PInfo 0.6.9-5.1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the… |
CVE-2016-20043 | High | 8.4 | 2026-03-28 | NRSS RSS Reader 0.3.9-1 contains a stack buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument… |
CVE-2016-20042 | High | 8.4 | 2026-03-28 | TRN 3.6-23 contains a stack buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized argument to the appli… |
CVE-2016-20041 | High | 8.4 | 2026-03-28 | Yasr 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized… |
CVE-2016-20040 | High | 8.4 | 2026-03-28 | TiEmu 3.03-nogdb+dfsg-3 contains a buffer overflow vulnerability in the ROM parameter handling that allows local attackers to crash the application or execute… |
CVE-2016-20039 | High | 8.4 | 2026-03-28 | Multi Emulator Super System 0.154-3.1 contains a buffer overflow vulnerability in the gamma parameter handling that allows local attackers to crash the applica… |
CVE-2016-20038 | High | 8.4 | 2026-03-28 | yTree 1.94-1.1 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an excessively long argu… |
CVE-2016-20037 | High | 8.4 | 2026-03-28 | xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long… |
CVE-2016-20036 | Medium | 6.1 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various… |
CVE-2016-20035 | Medium | 5.3 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious… |
CVE-2016-20034 | High | 8.8 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by… |
CVE-2016-20033 | High | 7.8 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable… |
CVE-2016-20032 | High | 7.2 | 2026-03-16 | ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by i… |
CVE-2016-20031 | Medium | 5.5 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by… |
CVE-2016-20030 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial char… |
CVE-2016-20029 | Medium | 6.2 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrie… |
CVE-2016-20028 | Medium | 4.3 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in user… |
CVE-2016-20027 | Medium | 6.1 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains multiple reflected cross-site scripting vulnerabilities that allow attackers to execute arbitrary HTML and script code by inj… |
CVE-2016-20026 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager applicat… |
CVE-2016-20025 | High | 8.8 | 2026-03-16 | ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying exec… |
CVE-2016-20024 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fil… |
CVE-2016-15057 | Critical | 9.9 | 2026-01-26 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.
This is… |
CVE-2016-20023 | Medium | 5.0 | 2025-12-05 | In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided. |
CVE-2016-15056 | | | 2025-11-14 | Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for dow… |
CVE-2016-15055 | | | 2025-11-12 | JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi e… |
CVE-2016-15053 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or es… |
CVE-2016-15052 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface. Insufficient validation or escaping of… |
CVE-2016-15051 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields… |
CVE-2016-15050 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorpor… |
CVE-2016-15049 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table… |
CVE-2016-15048 | Critical | 9.8 | 2025-10-22 | AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The… |
CVE-2016-15047 | | | 2025-10-09 | AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The `exefile` parameter in CloudSetup… |
CVE-2016-15046 | | | 2025-07-25 | A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager (SSM) versions 1.32 and 1.4, due to improper restrictions on… |
CVE-2016-15044 | | | 2025-07-23 | A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorserv… |
CVE-2016-15045 | | | 2025-07-23 | A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technolo… |
CVE-2016-15043 | Critical | 9.8 | 2025-07-19 | The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, a… |
CVE-2016-10408 | High | 8.4 | 2024-11-26 | QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable m… |
CVE-2016-10394 | High | 8.4 | 2024-11-26 | Initial xbl_sec revision does not have all the debug policy features and critical checks. |
CVE-2016-15042 | Critical | 9.8 | 2024-10-16 | The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to… |
CVE-2016-15041 | High | 7.2 | 2024-10-16 | The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2016-15040 | Critical | 9.8 | 2024-10-16 | The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and including, 2.8 due to… |
CVE-2016-15039 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the… |
CVE-2016-20022 | High | 8.4 | 2024-06-27 | In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: Thi… |
CVE-2016-15038 | Medium | 6.5 | 2024-04-01 | A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The ma… |
CVE-2016-15037 | Low | 2.4 | 2024-01-21 | A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a. Affected by this issue is some unknown functionality of… |
CVE-2016-20021 | Critical | 9.8 | 2024-01-12 | In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform… |