Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
65 results · page 2 of 2
Apr 10, 2018The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.CVE-2018-9985 · Other software · Metinfo · reported by MITREMedium 6.1
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2018The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to speCVE-2018-9934 · Other software · Metinfo · reported by MITREHigh 8.8
The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnblogs.comcnblogs.com
Apr 10, 2018Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parCVE-2018-9928 · Other software · Metinfo · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2018Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data.CVE-2018-7721 · Other software · Metinfo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2018An issue was discovered in MetInfo 6.0.0.CVE-2018-7271 · Other software · Metinfo · reported by MITREHigh 8.1
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2017Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingeCVE-2017-14513 · Other software · Metinfo · reported by MITREMedium 5.3
Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2017There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.CVE-2017-11718 · Other software · Metinfo Project · reported by MITREMedium 6.1
There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2017MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements bCVE-2017-11717 · Other software · Metinfo Project · reported by MITREHigh 7.5
MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2017MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.CVE-2017-11716 · Other software · Metinfo Project · reported by MITREMedium 6.1
MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2017job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to executeCVE-2017-11715 · Other software · Metinfo Project · reported by MITRECritical 9.8
job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2017A directory traversal vulnerability exists in MetInfo 5.3.17.CVE-2017-11500 · Other software · Metinfo · reported by MITREHigh 7.5
A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblackwolfsec.ccblackwolfsec.cc
Jul 19, 2017Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HCVE-2017-9764 · Other software · Metinfo · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious imaCVE-2017-11347 · Other software · Metinfo · reported by MITREHigh 8.8
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2017Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to CVE-2017-6878 · Other software · Metinfo · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 1, 2011Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword pCVE-2010-4976 · Other software · Metinfo · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third party information.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.