Vulnerabilities

Filters

Reset all

1 selected

33 records

Sort

Vendor: mojoomla Clear all filters

TI-2025-14277 CVE-2025-15657 · GHSA-53w7-8qrj-2848

WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability

LOW 29

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00221 Published 2026-06-17 No fix listed CWE-639

TI-2026-28412 CVE-2026-39433 · GHSA-w2j3-cpf2-jmr2

WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability

LOW 29

Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00352 Published 2026-06-16 Fixed in 49.5.3 CWE-862

TI-2025-14276 CVE-2025-15656 · GHSA-45c8-xxm2-wjfx

WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00232 Published 2026-06-03 No fix listed CWE-266

TI-2025-14275 CVE-2025-15655 · GHSA-v724-gm7g-f37c

WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00231 Published 2026-06-03 No fix listed CWE-89

TI-2025-23400 CVE-2025-32303 · GHSA-3qwf-r3rp-vfpr

WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00281 Published 2026-01-07 No fix listed CWE-89

TI-2025-23401 CVE-2025-32304 · GHSA-h7m2-q9p3-g2rg

WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00491 Published 2026-01-06 No fix listed CWE-98

TI-2025-22370 CVE-2025-31100 · GHSA-7vgp-hcc6-m685

WordPress School Management Plugin <= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability

MEDIUM 43

Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 (02-07-2025).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00367 Published 2025-08-31 No fix listed CWE-434

TI-2025-30478 CVE-2025-48108 · GHSA-jmrc-w5x6-6cjh

WordPress School Management Plugin <= 93.2.0 - Broken Access Control Vulnerability

LOW 28

Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects School Management: from n/a through 93.2.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00227 Published 2025-08-26 No fix listed CWE-862

TI-2025-23639 CVE-2025-32574 · GHSA-5m6f-r8fx-q83m

WordPress WPGYM plugin <= 65.0 - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows SQL Injection.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00398 Published 2025-07-16 No fix listed CWE-89

TI-2025-18491 CVE-2025-24774 · GHSA-5jwj-m487-96v3

Cross-site scripting in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows Reflected XSS.This issue affects WPCRM - CRM for…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0026 Published 2025-06-27 No fix listed CWE-79

TI-2025-30071 CVE-2025-47574 · GHSA-vjw8-j5r9-hg9g

WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00252 Published 2025-06-27 No fix listed CWE-79

TI-2025-18490 CVE-2025-24773 · GHSA-vfx6-p2r7-96qp

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00398 Published 2025-06-17 No fix listed CWE-89

TI-2025-23614 CVE-2025-32549 · GHSA-4gcj-p86p-q3c8

WordPress WPGYM <= 65.0 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00691 Published 2025-06-17 No fix listed CWE-98

TI-2025-30069 CVE-2025-47572 · GHSA-xg5v-gfhf-3q32

WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00734 Published 2025-06-17 No fix listed CWE-98

TI-2025-30070 CVE-2025-47573 · GHSA-rmg5-5xw5-rw5p

WordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00451 Published 2025-06-17 No fix listed CWE-89

TI-2025-30072 CVE-2025-47575 · GHSA-2v3m-6ccx-2995

WordPress School Management plugin <= 92.0.0 - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows SQL Injection.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00345 Published 2025-05-23 No fix listed CWE-89

TI-2025-30110 CVE-2025-47613 · GHSA-m6x2-v3jc-m2m7

WordPress School Management System for Wordpress plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00288 Published 2025-05-23 No fix listed CWE-79

TI-2025-30128 CVE-2025-47631 · GHSA-mqvg-gc79-6rxx

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in mojoomla Hospital Management System allows Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0037 Published 2025-05-23 No fix listed CWE-266

TI-2025-30160 CVE-2025-47663 · GHSA-f9xv-95hg-pxgf

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability

MEDIUM 43

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00435 Published 2025-05-23 No fix listed CWE-434

TI-2025-26099 CVE-2025-39357 · GHSA-pqfx-2rpj-fmv3

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management Sy…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00335 Published 2025-05-19 No fix listed CWE-89

TI-2025-26122 CVE-2025-39380 · GHSA-j23f-5pvr-62h7

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability

MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Server.This issue affects Hospital Management System: from n/a t…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00439 Published 2025-05-19 No fix listed CWE-434

TI-2025-26128 CVE-2025-39386 · GHSA-77cx-wrr4-hvr9

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability

MEDIUM 46

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00358 Published 2025-05-19 No fix listed CWE-89

TI-2025-26134 CVE-2025-39392 · GHSA-9458-hcvv-2c36

WordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-202…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00233 Published 2025-05-19 No fix listed CWE-79

TI-2025-26135 CVE-2025-39393 · GHSA-vvpw-jpw8-hr7r

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management Sy…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00233 Published 2025-05-19 No fix listed CWE-79

TI-2025-26137 CVE-2025-39395 · GHSA-x74x-7784-j459

WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-202…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00368 Published 2025-05-19 No fix listed CWE-89