Vendors / Vanguard Project Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Vanguard Project records in CISA KEV No Vanguard Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 47
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.
CVSS 3.0 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.06031 · Published 2017-12-24 · No fix listed CWE-434
Priority MEDIUM 47
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02652 · Published 2017-12-24 · No fix listed CWE-89
Priority LOW 38
Vanguard Marketplace Digital Products PHP has CSRF via /search.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00456 · Published 2017-12-28 · No fix listed CWE-352
Priority LOW 30
An issue was discovered in the Vanguard plugin 2.1 for WordPress.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01167 · Published 2020-07-05 · No fix listed CWE-79
Priority LOW 28
Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00622 · Published 2017-12-28 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 2 2 0 0
