Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
887 results · page 2 of 18
Feb 19, 2026Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability.CVE-2026-26359 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.
- Product
- Unisphere for PowerMax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability.CVE-2026-26358 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Unisphere for PowerMax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilitCVE-2026-26357 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Unisphere for PowerMax 9.2.4.18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulneraCVE-2026-23861 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Unisphere for PowerMax vApp,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An issue was discovered in Pacom Unison Client 5.13.1.CVE-2025-65480 · Other software · reported by MITREHigh 8.8
An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabiliCVE-2025-36588 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- Unisphere for PowerMax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability.CVE-2025-36589 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data and resources outside of the intended sphere of control.
- Product
- Unisphere for PowerMax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS.CVE-2025-6923 · Other software · Talent Software · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957.
- Product
- UNIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 9, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL Injection.CVE-2025-12504 · Other software · Talent Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL Injection. This issue affects UNIS: before 42321.
- Product
- UNIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61619 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61618 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61617 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61610 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In modem, there is a possible system crash due to improper input validation.CVE-2025-61609 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61608 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-61607 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In dpc modem, there is a possible system crash due to null pointer dereference.CVE-2025-3012 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-11133 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-11132 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025In nr modem, there is a possible system crash due to improper input validation.CVE-2025-11131 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
- Product
- T8100/T9100/T8200/T8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025In TEE EcDSA algorithm, there is a possible memory consistency issue.CVE-2025-31719 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.1
In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature results with low probability.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025In modem, there is a possible system crash due to improper input validation.CVE-2025-31718 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
- Product
- T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025In modem, there is a possible system crash due to improper input validation.CVE-2025-31717 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
- Product
- T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootRom, there's a possible missing payload size check.CVE-2022-38696 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootRom, there's a possible unchecked command index.CVE-2022-38695 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootRom, there is a possible unchecked write address.CVE-2022-38694 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SC9863A//T310/T610/T618/
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In FDL1, there is a possible missing payload size check.CVE-2022-38693 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation.CVE-2022-38692 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootROM, there is a possible missing validation for Certificate Type 0.CVE-2022-38691 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SC9863A//T310/T610/T618/
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2025In vowifi service, there is a possible command injection due to improper input validation.CVE-2025-31715 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
- Product
- SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2025In Developer Tools, there is a possible missing verification incorrect input.CVE-2025-31714 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 6.8
In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2025In engineer mode service, there is a possible command injection due to improper input validation.CVE-2025-31713 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 8.4
In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality.CVE-2025-50754 · Other software · reported by MITRECritical 9.6
Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025In bootloader, there is a possible out of bounds write due to a missing bounds check.CVE-2025-31716 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.1
In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulCVE-2025-36595 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025In cplog service, there is a possible out of bounds write due to a missing bounds check.CVE-2025-31712 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.1
In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025In cplog service, there is a possible system crash due to null pointer dereference.CVE-2025-31711 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.1
In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025In engineermode service, there is a possible command injection due to improper input validation.CVE-2025-31710 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.9
In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- SC9863A/T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025In sprd ssense service, there is a possible missing permission check.CVE-2024-39442 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 6.2
In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition functionCVE-2025-25962 · Other software · reported by MITRECritical 9.8
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special ElemCVE-2025-27686 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
- Product
- Unisphere for PowerMax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Small Package Quotes – Unishippers Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26918 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Reflected XSS.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025In wifi display, there is a possible missing permission check.CVE-2024-39441 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.1
In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed.
- Product
- T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Small Package Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-26960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025LTL Freight Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-22289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
- Product
- LTL Freight Quotes – Unishippers Edition
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025LTL Freight Quotes – Unishippers Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22284 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
- Product
- LTL Freight Quotes – Unishippers Edition
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025LTL Freight Quotes – Unishippers Edition: SQL InjectionCVE-2024-13477 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 2.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- LTL Freight Quotes – Unishippers Edition
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2025Small Package Quotes – Unishippers Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24665 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.8
- What to do
- Affects up to 2.4.8. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting theCVE-2024-21546 · Other software · reported by report@snyk.ioHigh 8.9
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 9, 2024In DRM service, there is a possible system crash due to null pointer dereference.CVE-2024-39440 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 6.2
In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed.
- Product
- T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.