Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

981 results · page 18 of 20

Aug 10, 2021A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).CVE-2021-37390 · Other software · Chamilo · reported by MITREMedium 6.1
A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitbook.seguranca-informatica.pt github.com
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
Product
WP LMS – Best WordPress LMS
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.9.2
What to do
Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2021An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23.CVE-2021-35208 · Email & office · Zimbra · reported by MITREMedium 5.4
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com wiki.zimbra.com
Jun 9, 2021Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via localCVE-2020-8704 · Other software · Intel · reported by secure@intel.comMedium 6.4
Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
Local Manageability Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com intel.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Fixed in
4.21.1
What to do
Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
May 6, 2021Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit usCVE-2020-23128 · Other software · Chamilo · reported by MITREMedium 4.9
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.chamilo.org toandak.blogspot.com
May 6, 2021Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.CVE-2020-23127 · Other software · Chamilo · reported by MITREHigh 8.8
Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.chamilo.org toandak.blogspot.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · WordPress plugins & themes · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24183 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24182 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24181 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Nov 12, 2020Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which: An unauthenticated SQL InjectionCVE-2020-27481 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Product
Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 8, 2020forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the CVE-2020-26802 · Other software · Formalms · reported by MITREHigh 8.8
forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover.
Product
Formalms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Aug 31, 2020Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV6CVE-2020-2075 · Other software · Sick · reported by psirt@sick.deHigh 7.5
Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x, MSC800, RFH.
Product
Lms111 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com sick.com
Aug 21, 2020Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to aCVE-2020-5775 · Other software · Instructure · reported by vulnreport@tenable.comMedium 5.8
Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.
Product
Canvas Learning Management Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Mar 31, 2020LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionCVE-2020-6008 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
Fixed in
3.37.15
What to do
Update the plugin to 3.37.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2020An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301.CVE-2020-8810 · Other software · Gurux · reported by MITREHigh 8.1
An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.
Product
Device Language Message Specification Director
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seqred.pl
Feb 25, 2020Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection.CVE-2020-8809 · Other software · Gurux · reported by MITREHigh 8.1
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.
Product
Device Language Message Specification Director
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seqred.pl
Feb 8, 2020Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML CVE-2012-4029 · Other software · Chamilo · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.
Product
Chamilo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.chamilo.org packetstormsecurity.com
Feb 4, 2020A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malCVE-2020-8615 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Product
A CSRF vulnerability in the Tutor LMS
Fixed in
1.5.3
What to do
Update A CSRF vulnerability in the Tutor LMS to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jan 16, 2020The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.CVE-2020-7108 · WordPress plugins & themes · reported by MITREMedium 5.4
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
Product
LearnDash LMS
Fixed in
3.1.2
What to do
Update LearnDash LMS to 3.1.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com learndash.releasenotes.io
Jan 10, 2020Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.CVE-2012-4030 · Other software · Chamilo · reported by MITREHigh 7.5
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Jan 4, 2020Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503.CVE-2015-9540 · Other software · Chamilo · reported by MITREMedium 6.1
Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.chamilo.org support.chamilo.org
Dec 25, 2019libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer oveCVE-2019-19977 · Other software · Libesmtp Project · reported by MITRECritical 9.8
libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.
Product
Libesmtp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 3, 2019Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.CVE-2019-5112 · Other software · Formalms · reported by talos-cna@cisco.comHigh 8.8
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_status was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.
Product
Formalms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 3, 2019Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.CVE-2019-5111 · Other software · Formalms · reported by talos-cna@cisco.comHigh 8.8
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.
Product
Formalms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 3, 2019Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1.CVE-2019-5110 · Other software · Formalms · reported by talos-cna@cisco.comHigh 8.8
Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.
Product
Formalms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 3, 2019Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1.CVE-2019-5109 · Other software · Formalms · reported by talos-cna@cisco.comHigh 8.8
Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.
Product
Formalms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 10, 2019An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.CVE-2019-15896 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
Product
An issue was discovered in the LifterLMS
Affected
up to 3.34.5
What to do
Affects up to 3.34.5. Update An issue was discovered in the LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Sep 9, 2019Sakai through 12.6 allows XSS via a chat user name.CVE-2019-16148 · Other software · Sakailms · reported by MITREMedium 6.1
Sakai through 12.6 allows XSS via a chat user name.
Product
Sakai
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2019An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier.CVE-2019-5070 · Other software · Epignosishq · reported by talos-cna@cisco.comMedium 6.5
An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Product
Efront LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 5, 2019A code execution vulnerability exists in Epignosis eFront LMS v5.2.12.CVE-2019-5069 · Other software · Epignosishq · reported by talos-cna@cisco.comHigh 8.8
A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.
Product
Efront LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Jun 30, 2019Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature.CVE-2019-13082 · Other software · Chamilo · reported by MITRECritical 9.8
Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0xecute.com support.chamilo.org
May 24, 2019SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, ICVE-2018-17843 · Other software · Mlmsoftwarez · reported by MITRECritical 9.8
SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0 via the member/readmsg.php msg_id parameter, the member/tree.php pid parameter, or the member/downline.php m_id parameter.
Product
ADD Clicking MLM Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 4, 2019Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user CVE-2019-1000017 · Other software · Chamilo · reported by MITREMedium 6.5
Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.chamilo.org
Feb 4, 2019Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.pCVE-2019-1000015 · Other software · Chamilo · reported by MITREMedium 6.1
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2018Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (whicCVE-2018-20329 · Other software · Chamilo · reported by MITREHigh 8.1
Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.chamilo.org
Dec 21, 2018Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under speciCVE-2018-20328 · Other software · Chamilo · reported by MITREMedium 5.4
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.chamilo.org
Dec 21, 2018Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to afCVE-2018-20327 · Other software · Chamilo · reported by MITREMedium 5.4
Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.chamilo.org
Dec 13, 2018A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete ManufacturCVE-2018-13804 · Other software · Siemens AG · reported by productcert@siemens.comHigh 8.1
A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.
Product
SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, S
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com cert-portal.siemens.com
Nov 6, 2018The realm server (tibrealmserver) component of TIBCO Software Inc.CVE-2018-12412 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 7.5
The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO FTL - Community Edition: versions up to and including 5.4.0, TIBCO FTL - Developer Edition: versions up to and including 5.4.0, TIBCO FTL - Enterprise Edition: versions up to and including 5.4.0.
Product
TIBCO FTL - Community Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tibco.com
Jul 23, 2018Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can CVE-2018-1999019 · Other software · Chamilo · reported by MITRECritical 9.8
Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com ibb.co
Jun 26, 2018A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with localCVE-2018-1000608 · Websites & servers · Jenkins · reported by MITREHigh 7.2
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password.
Product
Z/os Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 26, 2018lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files oCVE-2018-1000535 · Other software · LMS · reported by MITREHigh 7.5
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files on the server. This attack appear to be exploitable via GET parameter. This vulnerability appears to have been fixed in after commit 254765e.
Product
LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0dd.zone github.com
Nov 27, 2017In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server creaCVE-2017-0910 · Other software · Zulip · reported by support@hackerone.comHigh 8.8
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
Product
Zulip Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.org github.com
Oct 10, 2017Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.CVE-2015-6521 · Other software · Atutor · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.
Product
Atutor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.