Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 2 of 2
Jan 20, 2023EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".CVE-2022-45538 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".CVE-2022-45537 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filenaCVE-2021-39428 · Other software · Eyoucms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a CVE-2022-45280 · Other software · Eyoucms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2022-44390 · Other software · Eyoucms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module.CVE-2022-44389 · Other software · Eyoucms · reported by MITREMedium 6.5
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to arbitrarily change Administrator account information.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.CVE-2022-44387 · Other software · Eyoucms · reported by MITREHigh 8.8
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module.CVE-2022-43323 · Other software · Eyoucms · reported by MITREHigh 8.8
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points RecCVE-2022-41500 · Other software · Eyoucms · reported by MITREHigh 8.8
EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add.CVE-2022-36225 · Other software · Eyoucms · reported by MITREHigh 8.8
EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022An issue was discovered in EyouCMS 1.5.8.CVE-2022-35509 · Other software · Eyoucms · reported by MITREMedium 5.4
An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute arbitrary Web scripts or HTML by injecting a special payload via the title parameter in the foreground contribution, allowing the attacker to obtain sensitive information.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2022-33122 · Other software · Eyoucms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.CVE-2022-26273 · Other software · Eyoucms · reported by MITRECritical 9.8
EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.CVE-2022-26279 · Other software · Eyoucms · reported by MITRECritical 9.8
EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2022The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, whichCVE-2021-42194 · Other software · Eyoucms · reported by MITREHigh 7.2
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.CVE-2021-46255 · Other software · Eyoucms · reported by MITREHigh 8.1
eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2021SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to indexCVE-2020-24000 · Other software · Eyoucms · reported by MITRECritical 9.8
SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021EyouCMS 1.5.4 is vulnerable to Open Redirect.CVE-2021-39501 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Eyoucms 1.5.4 is vulnerable to Directory Traversal.CVE-2021-39500 · Other software · Eyoucms · reported by MITREHigh 7.5
Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` paCVE-2021-39499 · Other software · Eyoucms · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.CVE-2021-39497 · Other software · Eyoucms · reported by MITRECritical 9.8
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhptcybersec.comgithub.com
Sep 7, 2021Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.CVE-2021-39496 · Other software · Eyoucms · reported by MITREMedium 5.4
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.CVE-2020-20645 · Other software · Eyoucms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=neCVE-2020-20642 · Other software · Eyoucms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn.CVE-2020-19669 · Other software · Eyoucms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.CVE-2020-28146 · Other software · Eyoucms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 10, 2021A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HCVE-2020-21930 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts oCVE-2020-21929 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.CVE-2020-18129 · Other software · Eyoucms · reported by MITREHigh 8.8
A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbaike.baidu.combaike.baidu.com
Oct 10, 2019EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.CVE-2019-17430 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.