WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product print✕
Overview 407 matches · 4 in Waratek scope · 2 protected · 5 exploited · 0 CISA KEV · 57 public PoC · 7 EPSS ≥ 0.5
407matches 4in Waratek scope1.0% 2protected0.5% 5exploited1.2% 0CISA KEV0.0% 57public PoC14.0% 7EPSS ≥ 0.51.7%
Protected by Waratek 2 0.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 0.5% Outside Waratek scope 0 0.0% Not applicable 403 99.0% Withdrawn CVE 0 0.0%
Critical 76 18.7% High 169 41.5% Medium 150 36.9% Low 12 2.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 0.5% partly blocked 0 0.0% not blocked 405 99.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 1.2% Working exploit published 53 13.0% Proof of concept only 33 8.1% Forecast only 1 0.2% No public exploit 315 77.4%
split by peak 70 / year
Not applicable: 403No exploit published: 2Protected by Waratek: 2 Low: 12Medium: 150High: 169Critical: 76 not blocked: 405blocked by ARMR today: 2 No public exploit: 315Forecast only: 1Proof of concept only: 33Working exploit published: 53Exploited: 5
19993 Not applicable3 High3 not blocked3 Working exploit published3 20000 20014 Not applicable4 High1 Medium3 not blocked4 Working exploit published1 No public exploit3 20023 Not applicable3 Medium3 not blocked3 No public exploit3 20031 Not applicable1 High1 not blocked1 Working exploit published1 20042 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20055 Not applicable5 High1 Medium4 not blocked5 Working exploit published2 No public exploit3 20069 Not applicable9 High7 Medium2 not blocked9 Working exploit published4 No public exploit5 20078 Not applicable8 High7 Medium1 not blocked8 Working exploit published4 No public exploit4 200826 Not applicable26 High15 Medium11 not blocked26 Working exploit published9 Forecast only1 No public exploit16 200916 Not applicable16 High7 Medium7 Low2 not blocked16 Working exploit published2 No public exploit14 20108 Not applicable8 High7 Medium1 not blocked8 Working exploit published3 No public exploit5 201120 Not applicable20 High18 Medium2 not blocked20 Working exploit published3 No public exploit17 201215 Not applicable15 High12 Medium2 Low1 not blocked15 Exploited1 Working exploit published4 No public exploit10 201315 Not applicable15 High4 Medium8 Low3 not blocked15 No public exploit15 201419 Not applicable19 High9 Medium7 Low3 not blocked19 No public exploit19 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20164 Not applicable4 Critical2 High1 Medium1 not blocked4 No public exploit4 20178 Not applicable8 Critical1 High4 Medium3 not blocked8 Working exploit published1 No public exploit7 201813 Not applicable13 Critical2 High6 Medium5 not blocked13 Working exploit published1 No public exploit12 201918 Not applicable18 Critical5 High6 Medium7 not blocked18 Exploited1 Working exploit published3 No public exploit14 202010 Protected by Waratek1 No exploit published1 Not applicable8 Critical3 High6 Low1 blocked by ARMR today1 not blocked9 Working exploit published1 No public exploit9 202120 Not applicable20 Critical4 High8 Medium8 not blocked20 Working exploit published3 No public exploit17 202226 Not applicable26 Critical5 High9 Medium12 not blocked26 Exploited1 Working exploit published3 Proof of concept only4 No public exploit18 202328 Not applicable28 Critical4 High10 Medium13 Low1 not blocked28 Proof of concept only4 No public exploit24 202423 Not applicable23 Critical5 High7 Medium11 not blocked23 Exploited1 Proof of concept only4 No public exploit18 202570 Not applicable70 Critical38 High9 Medium22 Low1 not blocked70 Working exploit published1 Proof of concept only10 No public exploit59 202632 Protected by Waratek1 No exploit published1 Not applicable30 Critical7 High11 Medium14 blocked by ARMR today1 not blocked31 Exploited1 Working exploit published3 Proof of concept only11 No public exploit17
1999200220052008201120142017202020232026
407 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 5 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-91106 Critical 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91105 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91104 Critical 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91103 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91102 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91101 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91100 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91099 Medium 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91098 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-91097 High 2026-09-16 Not applicable No public exploit HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.
CVE-2026-55848 High 2026-08-28 Protected by Waratek Proof of concept only mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.
CVE-2026-44672 Critical 2026-05-28 No exploit published No public exploit mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.
CVE-2026-8632 High 2026-05-20 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.
CVE-2026-8631 Critical 2026-05-20 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data.
CVE-2026-3291 Medium 2026-05-06 Not applicable No public exploit Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
CVE-2026-5577 Medium 2026-04-05 Not applicable Proof of concept only A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquemachine_app.py of the component details Endpoint. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-30277 High 2026-03-31 Not applicable No public exploit An arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
CVE-2025-71260 High 2026-03-19 Not applicable Working exploit published BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVE-2025-71259 Medium 2026-03-19 Not applicable Working exploit published BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVE-2025-71258 Medium 2026-03-19 Not applicable Working exploit published BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVE-2025-71257 Medium 2026-03-19 Not applicable Exploited BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
CVE-2026-26725 Critical 2026-02-20 Not applicable No public exploit An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter.
CVE-2026-23892 Medium 2026-01-27 Not applicable No public exploit OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.
CVE-2025-68616 High 2026-01-19 Not applicable Proof of concept only WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
CVE-2020-36929 High 2026-01-16 Not applicable Proof of concept only Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.
CVE-2026-23496 Medium 2026-01-15 Not applicable Proof of concept only Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This vulnerability is fixed in 5.2.2 and 6.1.1.
CVE-2025-61550 Medium 2026-01-08 Not applicable Proof of concept only Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization. This allows attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions
CVE-2025-61549 Medium 2026-01-08 Not applicable Proof of concept only Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session
CVE-2025-61548 Critical 2026-01-08 Not applicable Proof of concept only SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands
CVE-2025-61547 Medium 2026-01-08 Not applicable Proof of concept only Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application does not implement proper CSRF tokens or other other protective measures, allowing a remote attacker to trick authenticated users into unknowingly executing unintended actions within their session. This can lead to unauthorized data modification such as credential updates.
CVE-2025-61546 Critical 2026-01-08 Not applicable Proof of concept only There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) that enables remote attacker to create financial discrepancies by purchasing items with a negative quantity. This vulnerability is possible due to reliance on client-side input validation controls.
CVE-2025-15464 High 2026-01-08 Not applicable Proof of concept only Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.
CVE-2025-64187 Medium 2025-11-07 Not applicable No public exploit OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.
CVE-2025-11607 Low 2025-10-11 Not applicable Proof of concept only A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing a manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVE-2025-49089 Medium 2025-09-15 Not applicable Proof of concept only wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.
CVE-2025-10472 Medium 2025-09-15 Not applicable Proof of concept only A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download_video/stream_video of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument file_path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-58180 High 2025-09-09 Not applicable Working exploit published OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.
CVE-2025-43023 Medium 2025-07-28 Not applicable No public exploit A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
CVE-2025-7897 Medium 2025-07-20 Not applicable No public exploit A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely.
CVE-2025-7896 Medium 2025-07-20 Not applicable No public exploit A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_video/delete_video of the file app/controllers/v1/video.py. The manipulation leads to path traversal. The attack can be launched remotely.
CVE-2025-7895 Medium 2025-07-20 Not applicable No public exploit A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file app/controllers/v1/video.py of the component File Extension Handler. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely.
CVE-2025-43025 Medium 2025-07-02 Not applicable No public exploit HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).
CVE-2025-48879 Medium 2025-06-10 Not applicable No public exploit OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.
CVE-2025-48067 Medium 2025-06-10 Not applicable No public exploit OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.
CVE-2025-5100 High 2025-05-23 Not applicable Proof of concept only A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution.
CVE-2025-5099 Critical 2025-05-23 Not applicable Proof of concept only An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.
CVE-2025-5098 Critical 2025-05-23 Not applicable Proof of concept only PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization.
CVE-2025-32788 Medium 2025-04-22 Not applicable No public exploit OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.
CVE-2025-3430 Medium 2025-04-08 Not applicable No public exploit The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-3429 Medium 2025-04-08 Not applicable No public exploit The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-3428 Medium 2025-04-08 Not applicable No public exploit The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-3427 Medium 2025-04-08 Not applicable No public exploit The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-27685 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001.
CVE-2025-27684 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
CVE-2025-27683 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File with Dangerous Type V-2022-006.
CVE-2025-27682 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
CVE-2025-27681 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.
CVE-2025-27680 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.
CVE-2025-27679 Medium 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Registration V-2023-005.
CVE-2025-27678 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023-001.
CVE-2025-27677 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
CVE-2025-27676 Medium 2025-03-05 Not applicable Proof of concept only Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2023-002.
CVE-2025-27675 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
CVE-2025-27674 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.
CVE-2025-27673 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.
CVE-2025-27672 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016.
CVE-2025-27671 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0015.
CVE-2025-27670 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20230524-0014.
CVE-2025-27669 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20230524-0013.
CVE-2025-27668 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20230524-0012.
CVE-2025-27667 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
CVE-2025-27666 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010.
CVE-2025-27665 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can have known malicious code OVE-20230524-0009.
CVE-2025-27664 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20230524-0008.
CVE-2025-27663 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.
CVE-2025-27662 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
CVE-2025-27661 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.
CVE-2025-27660 Medium 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20230524-0003.
CVE-2025-27659 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.
CVE-2025-27658 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524-0001.
CVE-2025-27657 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008.
CVE-2025-27656 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
CVE-2025-27655 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009.
CVE-2025-27654 Medium 2025-03-05 Not applicable Proof of concept only Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-017.
CVE-2025-27653 Medium 2025-03-05 Not applicable Proof of concept only Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripting (XSS): Badge Registration V-2023-012.
CVE-2025-27652 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015.
CVE-2025-27651 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014.
CVE-2025-27650 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013.
CVE-2025-27649 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-2023-016.
CVE-2025-27648 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003.
CVE-2025-27647 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002.
CVE-2025-27646 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001.
CVE-2025-27645 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permission Methods on the Server Side V-2024-005.
CVE-2025-27644 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-007.
CVE-2025-27643 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.
CVE-2025-27642 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Editing V-2024-008.
CVE-2025-27641 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009.
CVE-2025-27640 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012.
CVE-2025-27639 High 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.
CVE-2025-27638 Critical 2025-03-05 Not applicable No public exploit Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
‹ prev page 1 of 5 next ›