Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
84 results · page 2 of 2
Oct 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.CVE-2023-5564 · Other software · froxlor · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.CVE-2023-4304 · Other software · froxlor · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.CVE-2023-3668 · Other software · froxlor · reported by security@huntr.devHigh 7.2
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2023Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.CVE-2023-3192 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.CVE-2023-3173 · Other software · froxlor · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.CVE-2023-3172 · Other software · froxlor · reported by security@huntr.devHigh 7.2
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.CVE-2023-2666 · Other software · froxlor · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.CVE-2023-2034 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.CVE-2023-1307 · Other software · froxlor · reported by security@huntr.devCritical 9.8
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-1033 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-0877 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0671 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0572 · Other software · froxlor · reported by security@huntr.devMedium 5.3
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.CVE-2023-0566 · Other software · froxlor · reported by security@huntr.devMedium 6.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0565 · Other software · froxlor · reported by security@huntr.devMedium 5.5
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2023Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0564 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.CVE-2023-0316 · Other software · froxlor · reported by security@huntr.devMedium 5.5
Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.CVE-2023-0315 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 31, 2022Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4868 · Other software · froxlor · reported by security@huntr.devMedium 4.3
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4867 · Other software · froxlor · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.CVE-2022-4864 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2022Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.CVE-2022-3869 · Other software · froxlor · reported by security@huntr.devMedium 6.1
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.CVE-2022-3721 · Other software · froxlor · reported by security@huntr.devMedium 4.6
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.CVE-2022-3017 · Other software · froxlor · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter.CVE-2020-29653 · Other software · Froxlor · reported by MITREMedium 6.1
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2021Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via CVE-2020-28957 · Other software · Froxlor · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 12, 2021Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.CVE-2021-42325 · Other software · Froxlor · reported by MITRECritical 9.8
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 9, 2020An issue was discovered in Froxlor through 0.10.15.CVE-2020-10237 · Other software · Froxlor · reported by MITREMedium 5.5
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Mar 9, 2020An issue was discovered in Froxlor before 0.10.14.CVE-2020-10236 · Other software · Froxlor · reported by MITREMedium 6.1
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Mar 9, 2020An issue was discovered in Froxlor before 0.10.14.CVE-2020-10235 · Other software · Froxlor · reported by MITREHigh 8.8
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Jun 26, 2018Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote codeCVE-2018-1000527 · Other software · Froxlor · reported by MITREHigh 7.2
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.CVE-2018-12642 · Other software · Froxlor · reported by MITREHigh 7.5
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2017Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.CVE-2015-5959 · Other software · Froxlor · reported by MITRECritical 9.8
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 13, 2017Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by pCVE-2016-5100 · Other software · Froxlor · reported by MITRECritical 9.8
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.