Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,147 results · page 16 of 23
Sep 22, 2022Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=.CVE-2022-40088 · Other software · Simple College Website Project · reported by MITREMedium 6.1
Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
- Product
- Simple College Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgowthamaraj-rajendran.medium.comsourcecodester.com
Sep 22, 2022Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents().CVE-2022-40087 · Other software · Simple College Website Project · reported by MITRECritical 9.8
Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents(). This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Simple College Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgowthamaraj-rajendran.medium.comsourcecodester.com
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
- Product
- Site Offline Or Coming Soon Or Maintenance Mode
- Fixed in
- 1.5.3
- What to do
- Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2516 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.0
- What to do
- Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2430 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.0
- What to do
- Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 2, 2022Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25371 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 2, 2022Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25370 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Aug 31, 2022The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload.CVE-2022-37184 · Other software · Garage Management System Project · reported by MITREHigh 8.8
The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file.
- Product
- Garage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022OAKlouds Portal website’s Meeting Room has insufficient validation for user input.CVE-2022-38118 · Other software · HGiga · reported by twcert@cert.org.twHigh 8.8
OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.
- Product
- OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Aug 30, 2022Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code.CVE-2022-38116 · Other software · Le-yan Co., Ltd. · reported by twcert@cert.org.twCritical 9.8
Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.
- Product
- Personnel and Salary Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2022Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/dealCVE-2022-36572 · Other software · Sinsiu · reported by MITRECritical 9.8
Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/.
- Product
- Enterprise Website System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website.CVE-2022-1513 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website.
- Product
- PCManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Aug 19, 2022Project-nexus is a general-purpose blog website framework.CVE-2022-36030 · Other software · vinsdragonis · reported by GitHubCritical 9.8
Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of user input. This issue has not yet been patched. Users are advised to restrict user input and to upgrade when a new release becomes available.
- Product
- Project-Nexus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check.CVE-2022-20340 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-166269532
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 8, 2022A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 aCVE-2022-35493 · Websites & servers · Wrteam · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.
- Product
- Eshop - Ecommerce / Store Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2022WSM Downloader: Allows only specific popular websites to download images/files fromCVE-2022-2367 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
- Product
- WSM Downloader
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WSM Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Jul 28, 2022Unauthenticated redirection to a malicious websiteCVE-2022-27509 · Other software · Citirx · reported by secure@citrix.comMedium 6.1
Unauthenticated redirection to a malicious website
- Product
- Citrix Application Delivery Management (Citrix ADC) and Citrix Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 26, 2022Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a craCVE-2022-1497 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 18, 2022Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory.CVE-2022-30625 · Other software · Chcnav · reported by cna@cyber.gov.ilMedium 5.7
Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible.
- Product
- Chcnav - P5E GNSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31509 · Other software · Iedadata · reported by MITRECritical 9.3
The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Usap-dc Web Submission And Dataset Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS usCVE-2022-25238 · Other software · Silverstripe · reported by MITREMedium 5.4
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.silverstripe.orgforum.silverstripe.org
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comrotem-bar.com
Jun 9, 2022The Mechanize library is used for automating interaction with websites.CVE-2022-31033 · Other software · sparklemotion · reported by GitHubMedium 5.9
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
- Product
- mechanize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like FuCVE-2022-30015 · Other software · Simple Food Website Project · reported by MITREMedium 5.4
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
- Product
- Simple Food Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 23, 2022Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account.CVE-2022-30014 · Other software · Simple Food Website Project · reported by MITREHigh 8.8
Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account.
- Product
- Simple Food Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2022A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).CVE-2022-31268 · Other software · Gitblit · reported by MITREHigh 7.5
A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
- Product
- Gitblit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system.CVE-2021-27769 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 5, 2022Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications.CVE-2022-24899 · Other software · contao · reported by GitHubHigh 7.2
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts oCVE-2022-27330 · Websites & servers · E-commerce Website Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
- Product
- E-commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.CVE-2022-29967 · Other software · Glewlwyd Project · reported by MITREHigh 7.5
static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.
- Product
- Glewlwyd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022Origin Protocol is a blockchain based project.CVE-2022-24864 · Other software · OriginProtocol · reported by GitHubMedium 4.1
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds.
- Product
- origin-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
- Product
- Elementor Website Builder
- Affected
- 3.6.0 to 3.6.2
- What to do
- Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 8, 2022Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php.CVE-2022-27357 · Websites & servers · Ecommerce-website Project · reported by MITRECritical 9.8
Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Ecommerce-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 8, 2022Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides.CVE-2022-27346 · Websites & servers · Ecommerce-website Project · reported by MITREHigh 8.8
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Ecommerce-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 4, 2022A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2022-26615 · Other software · College Website Content Management System Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields.
- Product
- College Website Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or CVE-2022-27436 · Websites & servers · Ecommerce-website Project · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field.
- Product
- Ecommerce-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Apr 4, 2022An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image compoCVE-2022-27435 · Websites & servers · Ecommerce-website Project · reported by MITREHigh 8.8
An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component.
- Product
- Ecommerce-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Apr 3, 2022Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.CVE-2022-28376 · Other software · Verizon · reported by MITREHigh 8.1
Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.
- Product
- Lvskihp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022A vulnerability was found in College Website Management System 1.0 and classified as problematic.CVE-2022-1075 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched remotely and requires authentication.
- Product
- College Website Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comsourcecodester.com
Mar 25, 2022Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and inpuCVE-2022-27885 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint.CVE-2022-26285 · Other software · Simple Client Management System Project · reported by MITRECritical 9.8
Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.
- Product
- Simple Client Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint.CVE-2022-26283 · Other software · Oretnom23 · reported by MITRECritical 9.8
Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.
- Product
- Simple Subscription Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client anCVE-2020-24772 · Other software · Clash Project · reported by MITREHigh 8.8
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).
- Product
- Clash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files.CVE-2022-24075 · Other software · NAVER · reported by cve@navercorp.comMedium 6.5
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 16, 2022A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website.CVE-2021-33853 · Other software · X2engine · reported by disclose@cybersecurityworks.comMedium 5.4
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.
- Product
- X2crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Mar 2, 2022Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.CVE-2022-26170 · Other software · Simple Mobile Comparison Website Project · reported by MITRECritical 9.8
Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
- Product
- Simple Mobile Comparison Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously craftCVE-2021-44664 · Other software · Xerte · reported by MITREHigh 8.8
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
- Product
- Xerte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 21, 2022Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised.CVE-2021-24867 · WordPress plugins & themes · reported by WPScanCritical 9.8
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
- What to do
- Update the plugin to the newest version.
Feb 10, 2022PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) CVE-2022-0011 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.5
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier tha
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.