Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
106 results · page 2 of 3
Jun 23, 2026Crawl4AI is an open-source LLM friendly web crawler & scraper.CVE-2026-53753 · Other software · unclecode · reported by GitHubCritical 9.8
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
- Product
- crawl4ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML witCVE-2026-56263 · Other software · Crawl4AI · reported by VulnCheckMedium 5.3
Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files ouCVE-2026-56258 · Other software · Crawl4AI · reported by VulnCheckCritical 9.2
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 22, 2026Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplCVE-2026-56266 · Other software · Crawl4AI · reported by VulnCheckCritical 9.2
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2026Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server.CVE-2026-56265 · Other software · Crawl4AI · reported by VulnCheckCritical 9.3
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Crawlee is a web scraping and browser automation library.CVE-2026-46497 · Other software · apify · reported by GitHubLow 2.3
Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.
- Product
- crawlee-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification sCVE-2026-50213 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639High 8.7
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.
- Product
- Connect M6E 5G Portable WiFi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Crawlomatic Multipage Scraper Post Generator: Remote Code ExecutionCVE-2026-9009 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.
- Product
- Crawlomatic Multipage Scraper Post Generator
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 27, 2026rexCrawler: Stored Cross-Site ScriptingCVE-2026-2280 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- rexCrawler
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update rexCrawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2026The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().CVE-2026-8727 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.1
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
- Product
- Extension "Site Crawler"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data.CVE-2026-39416 · Other software · ail-project · reported by GitHubHigh 8.5
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.
- Product
- ail-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulnerability.circl.lu
Mar 26, 2026Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network CVE-2026-32857 · Other software · Firecrawl · reported by VulnCheckHigh 7.8
Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an externally valid URL that passes validation and returns an HTTP redirect to an internal or restricted resource, allowing the browser to follow the redirect and fetch the final destination without revalidation, thereby gaining access to internal network services and sensitive endpoints. This issue is distinct from CVE-2024-56800, which describes redirect-based SSRF generally. This vulnerability specifically arises from a post-redirect enforcement gap in implemented SSRF protections, where validation is applied only to the initial request and not to the final redirected destination.
- Product
- Firecrawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfirecrawl.dev
Mar 21, 2026rexCrawler: Reflected Cross-Site ScriptingCVE-2026-2277 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- rexCrawler
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update rexCrawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2026Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment.CVE-2026-26217 · Other software · unclecode · reported by VulnCheckCritical 9.2
Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment.CVE-2026-26216 · Other software · unclecode · reported by VulnCheckCritical 10
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026TextCrawler Pro 3.1.1 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized buffer in the license keCVE-2020-37213 · Other software · DigitalVolcano Software · reported by VulnCheckMedium 6.7
TextCrawler Pro 3.1.1 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized buffer in the license key field. Attackers can generate a 6000-byte payload and paste it into the activation field to trigger an application crash.
- Product
- TextCrawler Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigitalvolcano.co.ukexploit-db.com
Jan 19, 2026CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots.CVE-2026-23875 · Other software · crawlchat · reported by GitHubMedium 5.7
CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.
- Product
- crawlchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025SmartCrawl: Missing AuthorizationCVE-2025-62048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.
- Product
- SmartCrawl
- Affected
- up to 3.14.3
- What to do
- Affects up to 3.14.3. Update SmartCrawl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2025SmartCrawl SEO checker, analyzer & optimizer: Unauthorized modification of dataCVE-2025-11163 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
- Product
- SmartCrawl SEO checker, analyzer & optimizer
- Affected
- up to 3.14.3
- What to do
- Affects up to 3.14.3. Update SmartCrawl SEO checker, analyzer & optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2025Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.CVE-2025-56762 · Other software · Paracrawl · reported by MITREMedium 6.1
Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.
- Product
- Keops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Catalog Importer, Scraper & Crawler: PHP code injectionCVE-2025-8417 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.
- Product
- Catalog Importer, Scraper & Crawler
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2025Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2025-9376 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 11.58
- What to do
- Affects up to 11.58. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2025Firecrawl turns entire websites into LLM-ready markdown or structured data.CVE-2025-57818 · Other software · firecrawl · reported by GitHubMedium 6.3
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.
- Product
- firecrawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Insertion of Sensitive Information Into Sent DataCVE-2025-49294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Missing AuthorizationCVE-2025-49293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2025Crawlomatic Multipage Scraper Post Generator: Arbitrary file uploadsCVE-2025-4389 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Crawlomatic Multipage Scraper Post Generator
- Affected
- up to 2.6.8.1
- What to do
- Affects up to 2.6.8.1. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 18, 2025Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.CVE-2025-28197 · Other software · Kidocode · reported by MITRECritical 9.1
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
- Product
- Crawl4ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.CVE-2024-12450 · Other software · infiniflow · reported by security@huntr.devCritical 9.8
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.
- Product
- infiniflow/ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.
- Product
- Catalog Importer, Scraper & Crawler
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2024Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model.CVE-2024-56800 · Other software · mendableai · reported by GitHubHigh 7.4
Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address. This allowed exfiltration of local network resources through the API. The cloud service was patched on December 27th, 2024, and the maintainers have checked that no user data was exposed by this vulnerability. Scraping engines used in the open sourced version of Firecrawl were patched on December 29th, 2024, except for the playwright services which the maintainers have determined to be un-patchable. All users of open-source software (OSS) Firecrawl should upgrade to v1.1.1. As a workaround, OSS Firecrawl users should supply the playwright services with a secure proxy. A proxy can be specified through the `PROXY_SERVER` env in the environment variables. Please refer to the documentation for instructions. Ensure that the proxy server one is using is setup to block all traffic going to link-local IP addresses.
- Product
- firecrawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Full Path DisclosureCVE-2024-6556 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10.8. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
- Affected
- up to 3.10.8
- What to do
- Affects up to 3.10.8. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2024Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2024-4355 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the stopbadbots_get_ajax_data() function in all versions up to, and including, 10.23. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose visitor data.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 10.23
- What to do
- Affects up to 10.23. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Unauthorized ld+json description injectionCVE-2024-3287 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types.
- Product
- SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
- Affected
- up to 3.10.2
- What to do
- Affects up to 3.10.2. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 26, 2024With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=urlCVE-2024-0243 · Other software · langchain-ai · reported by security@huntr.devHigh 8.1
With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559
- Product
- langchain-ai/langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0.CVE-2024-22648 · Other software · Seopanel · reported by MITREMedium 5.3
A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports in the local environment.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
- Product
- SmartCrawl
- Fixed in
- 3.8.3
- What to do
- Update SmartCrawl to 3.8.3 or newer.
Oct 19, 2023LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.CVE-2023-46229 · Other software · Langchain · reported by MITREHigh 8.8
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
- Product
- Langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 7.24
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Jan 26, 2022Gerapy is a distributed crawler management framework.CVE-2021-32849 · Other software · Gerapy · reported by GitHubHigh 8.8
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
- Product
- gerapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021Gerapy is a distributed crawler management framework.CVE-2021-43857 · Other software · Gerapy · reported by GitHubCritical 9.8
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
- Product
- Gerapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2021WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots: Does not sanitise and escape the User Agent before using it in a SQL statement to save itCVE-2021-24863 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
- Product
- WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots
- Fixed in
- 6.67
- What to do
- Update WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots to 6.67 or newer.
Oct 6, 2021Scrapy is a high-level web crawling and scraping framework for Python.CVE-2021-41125 · Other software · scrapy · reported by GitHubMedium 5.7
Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target. This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects. Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead. If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the `w3lib.http.basic_auth_header` function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using `HttpAuthMiddleware`.
- Product
- scrapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoc.scrapy.orggithub.com
May 13, 2021Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature.CVE-2021-22140 · Other software · Elastic · reported by security@elastic.coHigh 7.5
Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.
- Product
- Elastic App Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Mar 22, 2021This affects the package es6-crawler-detect before 3.1.3.CVE-2020-28501 · Other software · Crawlerdetect Project · reported by report@snyk.ioMedium 5.3
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
- Product
- Crawlerdetect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2020Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc filCVE-2020-11722 · Other software · Dungeon Crawl Stone Soup Project · reported by MITRECritical 9.8
Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
- Product
- Dungeon Crawl Stone Soup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgdpmendenhall.blogspot.com
Jan 30, 2020All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.CVE-2019-10782 · Other software · Checkstyle · reported by report@snyk.ioMedium 5.3
All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.
- Product
- Checkstyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen.CVE-2018-20151 · WordPress plugins & themes · reported by MITREHigh 7.5
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Oct 1, 2012The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and executCVE-2012-5223 · Other software · Crawlability · reported by MITREHigh 7.5
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.
- Product
- Vbseo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2011Unspecified vulnerability in CrawlTrack before 3.2.7, when a public stats page is provided, allows remote attackers to execute arbitrary PHP code via unknown veCVE-2010-4537 · Other software · Crawltrack · reported by Red HatMedium 6.8
Unspecified vulnerability in CrawlTrack before 3.2.7, when a public stats page is provided, allows remote attackers to execute arbitrary PHP code via unknown vectors.
- Product
- Crawltrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.