Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
981 results · page 12 of 20
Dec 14, 2023A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injCVE-2023-50566 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the contCVE-2023-6790 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.8
A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Dec 13, 2023An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to thCVE-2023-6720 · Other software · Repox · reported by cve-coordination@incibe.esMedium 5.5
An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to the lack of proper sanitisation of field elements, allowing the attacker to trigger the malicious payload when the application loads.
- Product
- Repox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload inCVE-2023-49488 · Other software · Openfiler · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the nic parameter.
- Product
- Openfiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type.CVE-2023-6245 · Other software · Internet Computer · reported by 6b35d637-e00f-4228-858c-b20ad6e1d07bHigh 7.5
The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop. Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round. Repeated exposure to the payload will result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected.
- Product
- Candid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the pagCVE-2023-46974 · Other software · Mayurik · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL.
- Product
- Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parametCVE-2023-48823 · Other software · Mayurik · reported by MITRECritical 9.8
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
- Product
- Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 30, 2023SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/adCVE-2023-46956 · Other software · Oretnom23 · reported by MITREHigh 7.2
SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
- Product
- Packers And Movers Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injCVE-2023-48882 · Other software · Eyoucms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injCVE-2023-48881 · Other software · Eyoucms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injCVE-2023-48880 · Other software · Eyoucms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's mCVE-2023-43701 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Nov 9, 2023Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/indCVE-2023-46492 · Other software · Mldb · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/index.html.
- Product
- Machine Learning Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 8, 2023Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of thCVE-2023-46483 · Other software · Timeteccloud · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of the New Zone function.
- Product
- Auto Web-based Database Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.CVE-2023-46501 · Other software · boltwire · reported by MITRECritical 9.1
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.
- Product
- boltwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), CVE-2023-46998 · Other software · Bootboxjs · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.
- Product
- Bootbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023 A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags CVE-2023-1715 · Other software · Bitrix24 · reported by info@starlabs.sgCritical 9
A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.
- Product
- Bitrix24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgstarlabs.sg
Oct 30, 2023Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php fCVE-2023-46040 · Other software · Get-simple · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username paramCVE-2023-46467 · Other software · Juzaweb · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.CVE-2023-43352 · Other software · Cmsmadesimple · reported by MITREHigh 7.8
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.CVE-2023-44794 · Other software · dromara · reported by MITRECritical 9.8
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
- Product
- sa-token
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ServiceCVE-2023-46059 · Other software · Geeklog · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL to Ping parameters of the admin/trackback.php component.
- Product
- Geeklog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desCVE-2023-46058 · Other software · Geeklog · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the admin/group.php component.
- Product
- Geeklog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadminCVE-2023-43340 · Other software · EVO · reported by MITREMedium 5.2
Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters
- Product
- Evolution CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameterCVE-2023-43341 · Other software · EVO · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.
- Product
- Evolution CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().CVE-2023-46042 · Other software · Get-simple · reported by MITRECritical 9.8
An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023 IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload.CVE-2022-43893 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634.
- Product
- Security Verify Privilege
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 16, 2023The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload.CVE-2023-38059 · Other software · OTRS AG · reported by security@otrs.comMedium 5.3
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of CVE-2023-44813 · Other software · Moosocial · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_urlCVE-2023-44812 · Other software · Moosocial · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page TitlCVE-2023-44758 · Other software · gdidees · reported by MITREMedium 5.4
GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
- Product
- gdidees_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fieldCVE-2023-43877 · Other software · Ritecms · reported by MITREMedium 4.8
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter.CVE-2023-44075 · Other software · Small CRM Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter.
- Product
- Small CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.CVE-2023-4564 · Other software · Capensis · reported by cve-coordination@incibe.esMedium 4.7
This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.
- Product
- Canopsis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.canopsis.netgit.canopsis.net
Oct 3, 2023This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administCVE-2023-3196 · Other software · Capensis · reported by cve-coordination@incibe.esMedium 4.7
This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel.
- Product
- Canopsis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.canopsis.netgit.canopsis.net
Oct 3, 2023JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users beiCVE-2023-42508 · Other software · JFrog · reported by reefs@jfrog.comMedium 6.5
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.
- Product
- Artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload throuCVE-2023-32670 · Other software · BuddyBoss · reported by cve-coordination@incibe.esCritical 9
Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded.
- Product
- BuddyBoss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is serveCVE-2023-26146 · Other software · ithewei\/libhv · reported by report@snyk.ioMedium 6.1
All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.
- Product
- ithewei\/libhv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsecurity.snyk.io
Sep 28, 2023Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content BlocksCVE-2023-43879 · Other software · ritecms · reported by MITREMedium 4.8
Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu.
- Product
- ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu IteCVE-2023-43878 · Other software · Ritecms · reported by MITREMedium 5.4
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injecteCVE-2023-43876 · Other software · Octobercms · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.CVE-2023-41450 · Websites & servers · Phpkobo · reported by MITREHigh 8.8
An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd paramCVE-2023-41447 · Websites & servers · phpkobo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.
- Product
- ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameteCVE-2023-41453 · Websites & servers · Phpkobo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameter in the index.php component.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt paCVE-2023-41452 · Websites & servers · Phpkobo · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameteCVE-2023-41451 · Websites & servers · Phpkobo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.CVE-2023-41449 · Websites & servers · Phpkobo · reported by MITRECritical 9.8
An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameterCVE-2023-41448 · Websites & servers · Phpkobo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php coCVE-2023-41445 · Websites & servers · Phpkobo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php component.
- Product
- Ajaxnewsticker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 27, 2023A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2023-43828 · Other software · Intelliants · reported by MITREMedium 5.4
A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.
- Product
- Subrion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.