Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 16 of 43
Feb 17, 2024Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter.CVE-2024-21497 · Other software · Greenpau · reported by report@snyk.ioMedium 5.4
Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.
- Product
- Caddy-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comgithub.com
Feb 16, 2024In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.CVE-2024-0015 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Feb 15, 2024An Open Redirect vulnerability was found in osTicky2 below 2.2.8.CVE-2024-21728 · Other software · smartcalc.es · reported by security@joomla.orgMedium 6.1
An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return parameter in the URL to a base64 malicious URL.
- Product
- osTicky component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - thCVE-2023-5517 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comkb.isc.org
Feb 12, 2024Analytics Insights for Google Analytics 4 (AIWP): Is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callbackCVE-2024-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Analytics Insights for Google Analytics 4 (AIWP)
- Fixed in
- 6.3
- What to do
- Update Analytics Insights for Google Analytics 4 (AIWP) to 6.3 or newer.
Feb 12, 2024References to the "app loader" functionality could contain redirects to unexpected locations.CVE-2023-41708 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Feb 12, 2024All 404 Pages Redirect to Homepage: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24889 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9.
- Product
- All 404 Pages Redirect to Homepage
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update All 404 Pages Redirect to Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 10, 2024Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.CVE-2024-25715 · Other software · Glewlwyd SSO Server Project · reported by MITREMedium 6.1
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.
- Product
- Glewlwyd SSO Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().CVE-2023-50061 · Other software · store-opart · reported by MITRECritical 9.8
PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().
- Product
- op\'art_easy_redirect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgstore-opart.fr
Feb 8, 2024Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary code.CVE-2024-24034 · Other software · Setorinformatica · reported by MITREMedium 6.1
Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary code.
- Product
- S.i.l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024WP 404 Auto Redirect to Similar Post: Reflected Cross-Site ScriptingCVE-2024-0509 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP 404 Auto Redirect to Similar Post
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP 404 Auto Redirect to Similar Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.CVE-2024-21794 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 5.4
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Jan 31, 2024Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2023-50166 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
- Product
- Pega Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jan 29, 2024WordPress Toolbar: Redirects to any URL via the "wptbto" parameterCVE-2023-6389 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- WordPress Toolbar
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WordPress Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 26, 2024A flaw was found in the redirect_uri validation logic in Keycloak.CVE-2023-6291 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Product
- Red Hat build of Keycloak 22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 24, 2024Simple Membership: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-22308 · WordPress plugins & themes · reported by PatchstackLow 3.4
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1.
- Product
- Simple Membership
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-422CVE-2024-0854 · Network & remote access · Synology · reported by security@synology.comMedium 5.4
URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jan 23, 2024Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-contrCVE-2023-42143 · Other software · Shelly · reported by MITREMedium 5.4
Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is updated with the manipulated firmware.
- Product
- TRV Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect useCVE-2024-22113 · Other software · ANGLERSNET Co,.Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary websites and conduct phishing attacks via a specially crafted URL.
- Product
- Access analysis CGI An-Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server.CVE-2024-22212 · Other software · nextcloud · reported by GitHubCritical 9.6
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message.CVE-2023-45231 · Other software · TianoCore · reported by infosec@edk2.groups.ioMedium 6.5
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
- Product
- edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 16, 2024T1: Is vulnerable to unauthenticated open redirect withCVE-2023-3771 · WordPress plugins & themes · reported by WPScanMedium 6.1
The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.
- Product
- T1
- Affected
- up to 19.0
- What to do
- Affects up to 19.0. Update T1 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2024Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a maliciCVE-2024-0319 · Other software · FireEye · reported by cve-coordination@incibe.esMedium 5.4
Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a malicious page by changing the 'redirect_uri' parameter.
- Product
- FireEye HXTool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.CVE-2023-49394 · Other software · Easycorp · reported by MITREMedium 6.1
Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnarrow-payment-2cd.notion.site
Jan 8, 2024Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.CVE-2023-6552 · Other software · TasmoAdmin · reported by cvd@cert.plMedium 6.1
Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.
- Product
- TasmoAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to pCVE-2023-50345 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() functCVE-2023-26159 · Other software · Follow-redirects · reported by report@snyk.ioHigh 7.3
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
- Product
- Follow Redirects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect.CVE-2023-52263 · Other software · Brave · reported by MITREMedium 6.1
Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Calculated Fields Form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51517 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.
- Product
- Calculated Fields Form
- Affected
- up to 1.2.28
- What to do
- Affects up to 1.2.28. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
- Product
- Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
- Affected
- up to 6.9.18
- What to do
- Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-32517 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3.
- Product
- MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
- Affected
- up to 4.0.9.3
- What to do
- Affects up to 4.0.9.3. Update MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Library Viewer: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-32101 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pexle Chris Library Viewer.This issue affects Library Viewer: from n/a through 2.0.6.
- Product
- Library Viewer
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Library Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Zephyr Project Manager: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31237 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023WP Directory Kit: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31229 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9.
- Product
- WP Directory Kit
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31095 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.
- Product
- Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
- Product
- Solid Security – Password, Two Factor Authentication, and Brute Force Protection
- Affected
- up to 8.1.4
- What to do
- Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 26, 2023An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a craftedCVE-2023-49438 · Other software · Flask-security-too Project · reported by MITREMedium 6.1
An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.
- Product
- Flask-security-too
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the 'CVE-2023-48003 · Other software · Aspnetzero · reported by MITREMedium 6.1
An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' in the WebSocket messages.
- Product
- Asp.net Zero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unsafe-inline.comgithub.com
Dec 26, 2023Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites viaCVE-2023-50297 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
- Product
- PowerCMS (PowerCMS 6 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023 An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phiCVE-2023-50704 · Other software · EFACEC · reported by ics-cert@hq.dhs.govMedium 4.3
An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.
- Product
- UC 500E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023Parcel Pro: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-46624 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11.
- Product
- Parcel Pro
- Affected
- up to 1.6.11
- What to do
- Affects up to 1.6.11. Update Parcel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-37982 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
- Product
- Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Core Web Vitals & PageSpeed Booster: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-35883 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
- Product
- Core Web Vitals & PageSpeed Booster
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023affiliate-toolkit – WordPress Affiliate: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-45105 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9.
- Product
- affiliate-toolkit – WordPress Affiliate
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update affiliate-toolkit – WordPress Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Login and Logout Redirect: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-41648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.
- Product
- Login and Logout Redirect
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Login and Logout Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Doofinder WP & WooCommerce Search: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-40602 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
- Product
- Doofinder WP & WooCommerce Search
- Affected
- up to 1.5.49
- What to do
- Affects up to 1.5.49. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-38481 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7.
- Product
- Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin
- Fixed in
- 1.3.7
- What to do
- Update Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin to 1.3.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Integration for WooCommerce and QuickBooks: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-38478 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.
- Product
- Integration for WooCommerce and QuickBooks
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Redirect 404 Error Page to Homepage or Custom Page with Logs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47530 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Redirect 404 Error Page to Homepage or Custom Page with Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooCommerce Login Redirect: Cross-Site Request Forgery (CSRF)CVE-2023-48773 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
- Product
- WooCommerce Login Redirect
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WooCommerce Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.