Vulnerabilidades em metagauss

116 resultados
Análise Vexday

Com 54 CVEs catalogadas e nenhuma registrada no CISA KEV, a taxa de exploração ativa da Metagauss está abaixo da média geral do catálogo, o que sugere pressão ofensiva relativamente menor no momento. Ainda assim, 4 vulnerabilidades são classificadas como críticas e o tipo de falha mais recorrente — CWE-862 (Missing Authorization) — indica problemas estruturais de controle de acesso que podem facilitar escalonamento de privilégios ou acesso indevido a recursos protegidos. A CVE mais perigosa atualmente identificada é CVE-2024-10508, com escore EPSS de 0,0146, e a existência de ao menos uma PoC pública no conjunto reforça a necessidade de atenção na priorização de patches. As 4 CVEs surgidas nos últimos 90 dias indicam atividade contínua de descoberta, exigindo monitoramento próximo do ciclo de divulgação.

CVE-2024-13526MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees ExportEPSS 0.3%CVE-2026-32498HIGHWordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-13740MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages DisclosureEPSS 0.3%CVE-2024-47648MEDIUMWordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerabilityEPSS 0.3%CVE-2022-36345MEDIUMWordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-4608MEDIUMProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' ParameterEPSS 0.3%CVE-2025-49033HIGHWordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-24686HIGHWordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1321MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment BypassEPSS 0.3%CVE-2022-38062MEDIUMWordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-63007MEDIUMWordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-52719MEDIUMWordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) VulnerabilityEPSS 0.3%CVE-2026-25389MEDIUMWordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-1054MEDIUMRegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings ModificationEPSS 0.2%CVE-2025-4957HIGHWordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-82225HIGHWordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerabilityEPSS 0.2%CVE-2026-4607MEDIUMProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings ModificationEPSS 0.2%CVE-2025-48079MEDIUMWordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2024-31362MEDIUMWordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%