Advisories · Weakness
CWE-472.
Every Advisory and CVE whose sources give the weakness CWE-472, newest first.
- CVSS 7.5 High
MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation
- ThemeMove MinimogWP – The High Converting eCommerce WordPress Theme
- CWE-472
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Google Chrome: Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker…
- Google Chrome
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
- CWE-472
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 4.3 Medium
Missing Authorization check in SAP S4/HANA (OData meta-data property)
- SAP_SE SAP S4/HANA (OData meta-data property)
- CWE-472
- CVSS 8.8 High
BlueWave Checkmate: In BlueWave Checkmate through 2.0.2 before b387eba…
- BlueWave Checkmate
- CWE-472
- CVSS 6.9 MediumCritical · KEVKEV
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- CWE-472
<4.15.3 || >=5.0.0-alpha.1, <5.7.5 · fixed in 4.15.3, 5.7.5
GHSA-7vrx-9684-xrf2 · CVE-2025-35939 - CVSS 8.1 High
BlueWave Checkmate: In BlueWave Checkmate through 2.0.2 before d4a6072…
- BlueWave Checkmate
- CWE-472
- CVSS 5.3 Medium
Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation
- wpswings Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
- CWE-472
- CVSS 7.5 High
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
- mra13 Simple Shopping Cart
- CWE-472
- CVSS 4.3 Medium
OData meta-data property entity tampering in SAP Field Logistics
- SAP_SE SAP Field Logistics
- CWE-472
- CVSS 3.1 Low
CodeLit CourseLit: CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated…
- CodeLit CourseLit
- CWE-472
- CVSS 4.3 Medium
Odata meta-data tampering in SAP S4CORE entity
- SAP_SE SAP S4CORE entity
- CWE-472
- CVSS 6.5 Medium
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
- CWE-472
<1.6.2 || >=1.7.0, <1.7.2 || >=2.0.0, <2.0.2 · fixed in 1.6.2, 1.7.2, 2.0.2
GHSA-hxg4-65p5-9w37 · CVE-2025-30152 - CVSS 8.6 High
SecurEnvoy SecurAccess: Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only…
- SecurEnvoy SecurAccess
- CWE-472
- CVSS 6.5 Medium
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
- CWE-472
<1.6.1 || >=1.7.0, <1.7.1 || >=2.0.0, <2.0.1 · fixed in 1.6.1, 1.7.1, 2.0.1
GHSA-pqq3-q84h-pj6x · CVE-2025-29788 - CVSS 5.3 Medium
SendQuick Entera: SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the…
- SendQuick Entera
- CWE-472
- CVSS 1.8 Low
Archer: In Archer Platform 6 through 6.14.00202.10024…
- Archer
- CWE-472
- CVSS 7.5 High
An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 7.5 High
An issue was discovered in Optimizely Configured Commerce before 5.2.2408.
- CWE-472
- CVSS 5.4 Medium
TeamPass privileges issue
- Broken access control
- CWE-472
<3.1.3.1 · fixed in 3.1.3.1
GHSA-9wmc-988h-2mv2 · CVE-2024-50703 - CVSS 5.3 Medium
Unauthorized Modification of Ticket Requester
- Issuetrak
- CWE-472
- CWE-837
- CVSS 8.8 High
Google Chrome: Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.8 High
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 5.3 Medium
Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation
- StylemixThemes Cost Calculator Builder PRO
- CWE-472
- CVSS 6.5 Medium
WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering
- PINPOINT.WORLD Pinpoint Booking System
- CWE-472
- CVSS 3.7 Low
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability
- WpDevArt Booking calendar, Appointment Booking System
- CWE-472
- CVSS 5.3 Medium
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114
- Fortra FileCatalyst
- CWE-472
- CVSS 5.9 Medium
IBM Watson CP4D Data Stores improper input validation
- IBM Watson CP4D Data Stores
- CWE-472
- CVSS 5.3 Medium
Duplicate Advisory: httparty has multipart/form-data request tampering vulnerability
- Information disclosure
- CWE-472
<=0.20.0 · no fixed version yet
GHSA-g47j-3m2m-74qv - CVSS 6.5 Medium
httparty has multipart/form-data request tampering vulnerability
- CWE-472
<0.21.0 · fixed in 0.21.0
GHSA-5pq7-52mg-hr42 · CVE-2024-22049 - CVSS 5.3 Medium
External Control of Assumed-Immutable Web Parameter in moodle
- CWE-472
>=3.9, <3.9.14 || >=3.10, <3.10.11 || >=3.11, <3.11.7 || >=4.0, <4.0.1 · fixed in 3.9.14, 3.10.11, 3.11.7, 4.0.1
GHSA-x6gm-qqwp-76gr · CVE-2022-30597 - CVSS 6.8 Medium
HCL Sametime is vulnerable to arbitrary HTTP requests
- HCL Software Sametime
- CWE-472
- CVSS 5.3 Medium
HCL Sametime is vulnerable to an information disclosure
- HCL Software Sametime
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities
- Cisco Small Business RV Series Router Firmware
- CWE-472
- CVSS 3.5 Low
Spoofing of From field in several screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-472
-
Siemens AG Desigo PX automation controllers PXC00-E.D…: A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D…
- Siemens AG Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2
- Siemens AG Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2
- CWE-472
-
Cambium Networks cnPilot: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware…
- Cambium Networks cnPilot
- CWE-472
-
Cambium Networks cnPilot: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware…
- Cambium Networks cnPilot
- CWE-472