Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,611 results · page 18 of 73
Jan 9, 2026This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.CVE-2025-64092 · Other software · Zenitel · reported by cert@ncsc.nlHigh 7.5
This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.
- Product
- ICX500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-22032 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() functCVE-2026-22185 · Other software · OpenLDAP Foundation · reported by VulnCheckMedium 4.6
OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.
- Product
- OpenLDAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.openldap.orgseclists.org
Jan 7, 2026Advanced Database Cleaner PRO: Path Traversal: '.../...//'CVE-2025-46256 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10.
- Product
- Advanced Database Cleaner PRO
- Affected
- up to 3.2.10
- What to do
- Affects up to 3.2.10. Update Advanced Database Cleaner PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via BlinCVE-2025-59379 · Other software · Dwyeromega · reported by MITREHigh 7.5
DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may be cleartext, from existing users (and admins) and use them to authenticate to the application.
- Product
- Isensix Advanced Remote Monitoring System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominfo.dwyeromega.com
Jan 5, 2026Form Vibes – Database Manager for Forms: SQL InjectionCVE-2025-13409 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including, 1.4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Form Vibes – Database Manager for Forms
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update Form Vibes – Database Manager for Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64425 · Other software · coollabsio · reported by GitHubHigh 8.5
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will receive a password reset email, with a link to the malicious host. If the victim clicks this link, their reset token is sent to the attacker's server, allowing the attacker to use it to change the victim's password and takeover their account. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64424 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64423 · Other software · coollabsio · reported by GitHubHigh 7.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they use the link before the legitimate recipient does, they are able to log in as an administrator, meaning they have successfully escalated their privileges. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64422 · Other software · coollabsio · reported by GitHubMedium 5.5
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64421 · Other software · coollabsio · reported by GitHubHigh 8.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks the invite button a second time, it actually works. This way, a low privileged user can invite themselves as an administrator to the Coolify instance. After the high privileged user is invited, the attacker can initiate a password reset and log in with the new admin. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64420 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-64419 · Other software · coollabsio · reported by GitHubCritical 9.6
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59955 · Other software · coollabsio · reported by GitHubMedium 5.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59158 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated resource, the payload automatically executes in the admin’s browser context. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59157 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-59156 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the host OS, completely bypassing container isolation. Version 4.0.0-beta.420.7 contains a patch for the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries.CVE-2023-54163 · Other software · NLB Banka AD Skopje · reported by VulnCheckHigh 8.8
NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application.
- Product
- NLB mKlik Makedonija
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstormsecurity.com
Dec 24, 2025SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST pCVE-2018-25128 · Other software · SOCA Technology Co., Ltd · reported by VulnCheckCritical 9.3
SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by exploiting injection flaws in Login.php and Card_Edit_GetJson.php.
- Product
- SOCA Access Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsocatech.comexploit-db.com
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66213 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66212 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66211 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66210 · Other software · coollabsio · reported by GitHubCritical 9.4
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-66209 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable CVE-2021-47720 · Other software · Orangescrum · reported by VulnCheckHigh 8.7
Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like old_project_id, project_id, uuid, and uniqid to potentially extract or modify database information.
- Product
- orangescrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comorangescrum.org
Dec 22, 2025Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters.CVE-2023-53975 · Other software · thedigicraft · reported by VulnCheckCritical 9.3
Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.
- Product
- Atom CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 22, 2025WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries.CVE-2023-53972 · Other software · luiswang · reported by VulnCheckCritical 9.3
WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.
- Product
- WebTareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Dec 21, 2025Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed keCVE-2025-15016 · Other software · Ragic · reported by twcert@cert.org.twCritical 9.3
Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 21, 2025Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path TraversCVE-2025-15015 · Other software · Ragic · reported by twcert@cert.org.twHigh 8.7
Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 19, 2025pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation.CVE-2025-65035 · Other software · pluginsGLPI · reported by GitHubMedium 6.4
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.
- Product
- databaseinventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.CVE-2025-63948 · Other software · Craigtaub · reported by MITREMedium 5.4
A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname parameter, potentially leading to information disclosure or database manipulation.
- Product
- Phpmsadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.CVE-2025-63947 · Other software · Craigtaub · reported by MITREMedium 5.4
A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web script or HTML via the dbname parameter after a user is authenticated.
- Product
- Phpmsadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php.CVE-2023-53935 · Other software · Codester · reported by VulnCheckMedium 5.3
WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed requests to the ticket endpoint.
- Product
- WBiz Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodester.comexploit-db.com
Dec 18, 2025WordPress Contact Form 7 PDF, Google Sheet & Database: Unrestricted Upload of File with Dangerous TypeCVE-2025-64231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
- Product
- WordPress Contact Form 7 PDF, Google Sheet & Database
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update WordPress Contact Form 7 PDF, Google Sheet & Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.CVE-2025-68462 · Other software · Debian · reported by MITRELow 3.2
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
- Product
- FreedomBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries.CVE-2023-53926 · Websites & servers · PHPJabbers · reported by VulnCheckHigh 8.7
PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.
- Product
- Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comphpjabbers.com
Dec 17, 2025Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database querCVE-2023-53917 · Other software · powerstonegh · reported by VulnCheckHigh 8.7
Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database queries. Attackers can exploit the 'id' parameter with crafted union-based queries to extract sensitive user information including usernames and password hashes.
- Product
- Affiliate Me
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.compowerstonegh.com
Dec 15, 2025Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database conCVE-2025-14758 · Other software · ALASCA · reported by cve@gitlab.comMedium 6.5
Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials
- Product
- YAOOK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries.CVE-2023-53877 · Websites & servers · Phpjabbers · reported by VulnCheckCritical 9.3
Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database.
- Product
- Bus Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comphpjabbers.com
Dec 13, 2025Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly toCVE-2025-67896 · Other software · Exim · reported by MITREHigh 7
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
- Product
- Exim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025Blaze Demo Importer: Unauthorized database resets and file deletionCVE-2025-13334 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_demo" function in all versions up to, and including, 1.0.13. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the database by truncating all tables (except options, usermeta, and users), delete all sidebar widgets, theme modifications, and content of the uploads folder.
- Product
- Blaze Demo Importer
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Blaze Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2025xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL coCVE-2024-58309 · Other software · xbtitfm · reported by VulnCheckHigh 8.7
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.
- Product
- xbtitFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Dec 11, 2025CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database CVE-2024-58307 · Other software · cszcms · reported by VulnCheckCritical 9.3
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
- Product
- CSZCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netcszcms.com
Dec 11, 2025Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parametCVE-2024-58301 · Other software · purei · reported by VulnCheckCritical 9.3
Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.
- Product
- Purei CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpurei.comexploit-db.com
Dec 11, 2025Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through CVE-2024-58290 · Other software · Elements · reported by VulnCheckCritical 9.3
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.
- Product
- Xhibiter NFT Marketplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelements.envato.comexploit-db.com
Dec 10, 2025SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory.CVE-2020-36887 · Other software · SpinetiX AG · reported by VulnCheckHigh 8.7
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentials and system information.
- Product
- Fusion Digital Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comspinetix.com
Dec 9, 2025OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code.CVE-2021-47704 · Other software · OPEN BMCS · reported by VulnCheckHigh 8.7
OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to /debug/obix_test.php with malicious 'id' values to extract database information.
- Product
- OpenBMCS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comopenbmcs.com
Dec 9, 2025Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables intCVE-2025-42891 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.
- Product
- SAP Enterprise Search for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpCVE-2025-12807 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.
- Product
- FactoryTalk® DataMosaix™ Private Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Dec 8, 2025phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.CVE-2025-60912 · Websites & servers · Phpipam · reported by MITRELow 3.3
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.