Vanguard Project Marketplace Digital Products Php — known CVE vulnerabilities

Every CVE whose affected-product data names Vanguard Project Marketplace Digital Products Php, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2017-17873 — CVSS 9.8 (critical): Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
• CVE-2017-17874 — CVSS 8.8 (high): Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action…
• CVE-2017-17936 — CVSS 8.8 (high): Vanguard Marketplace Digital Products PHP has CSRF via /search.
• CVE-2017-17937 — CVSS 6.1 (medium): Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.