Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,618 results · page 21 of 73
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Cross-Site Request ForgeryCVE-2024-8520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-8519 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2024Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.CVE-2024-41587 · Network & remote access · Draytek · reported by MITREMedium 5.4
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
- Product
- Vigor3910 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforescout.comforescout.com
Oct 3, 2024A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.CVE-2024-42504 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.3
A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.
- Product
- HPE IceWall Agent products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check stateCVE-2024-24117 · Other software · Ruijie · reported by MITRECritical 9.8
Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component.
- Product
- Rg-nbs2009g-p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 1, 2024Loggedin – Limit Active Logins: Reflected Cross-Site ScriptingCVE-2024-9228 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when the leave a review notice is present.
- Product
- Loggedin – Limit Active Logins
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Loggedin – Limit Active Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2024Wechat Social login: Arbitrary file uploadsCVE-2024-9108 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Wechat Social login
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 1, 2024Wechat Social login: Authentication bypassCVE-2024-9106 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This is only exploitable if the app secret is not set, so it has a default empty value.
- Product
- Wechat Social login
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 27, 2024Simple LDAP Login: Reflected Cross-Site ScriptingCVE-2024-8715 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Simple LDAP Login
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Simple LDAP Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.CVE-2024-34542 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.9
Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.
- Product
- ADAM-5630
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page.CVE-2024-46472 · Other software · codeastro · reported by MITREHigh 8.6
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page.
- Product
- membership_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 27, 2024ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login.CVE-2024-46331 · Other software · modstart · reported by MITREHigh 7.2
ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to redirect users to an arbitrary website via a crafted URL.
- Product
- modstartcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-CVE-2023-52950 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors.
- Product
- Synology Active Backup for Business Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login.CVE-2024-47088 · Other software · Apex Softcell · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.
- Product
- LD Geo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Limit Login Attempts Plus: IP Address SpoofingCVE-2022-4533 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
- Product
- Limit Login Attempts Plus
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Limit Login Attempts Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 18, 2024Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows attackers to execute of arbitrary code.CVE-2024-44589 · Other software · dlink · reported by MITREHigh 8.8
Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows attackers to execute of arbitrary code.
- Product
- dcs-960l_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in tCVE-2024-42404 · Websites & servers · Welcart Inc. · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Houzez Login Register: Privilege EscalationCVE-2024-21743 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.
- Product
- Houzez Login Register
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Houzez Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2024Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the CVE-2024-45833 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.5
Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2024app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in CVE-2024-46918 · Other software · misp · reported by MITREMedium 4.9
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2024Login with phone number: Privilege escalationCVE-2024-6482 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49.
- Product
- Login with phone number
- Affected
- up to 1.7.49
- What to do
- Affects up to 1.7.49. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024YITH Custom Login: Reflected Cross-Site ScriptingCVE-2024-8665 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- YITH Custom Login
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update YITH Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 12, 2024ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.CVE-2024-34335 · Other software · ordat · reported by MITREMedium 6.1
ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.
- Product
- foss-online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024blogintroduction-wordpress-plugin: Does not have CSRF check in placeCVE-2024-7862 · WordPress plugins & themes · reported by WPScanMedium 6.5
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- blogintroduction-wordpress-plugin
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update blogintroduction-wordpress-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2024evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."CVE-2024-44541 · Other software · evilnapsis · reported by MITRECritical 9.8
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
- Product
- inventio-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login.CVE-2024-45790 · Other software · Reedos Software Solutions · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
- Product
- Mutual Fund Distribution Product (aiM-Star)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin.CVE-2024-42423 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized actions leading to information disclosure and tampering.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application.CVE-2024-45280 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.
- Product
- SAP NetWeaver AS Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.CVE-2024-45771 · Other software · openrapid · reported by MITRECritical 9.8
RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.
- Product
- rapidcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.CVE-2024-44838 · Other software · openrapid · reported by MITRECritical 9.8
RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.
- Product
- rapidcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.CVE-2024-44727 · Other software · sourcecodehero · reported by MITRECritical 9.8
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
- Product
- event_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2024The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on thCVE-2024-1621 · Other software · NT-ware · reported by 4586e0a2-224d-4f8a-9cb4-8882b208c0b3High 8.3
The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.
- Product
- uniFLOW Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordntware.atlassian.netcanon-europe.com
Aug 30, 2024Clean Login: Local File InclusionCVE-2024-8252 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Clean Login
- Affected
- up to 1.14.5
- What to do
- Affects up to 1.14.5. Update Clean Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2024A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login.CVE-2021-22530 · Other software · OpenText · reported by security@opentext.comHigh 8.2
A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1
- Product
- NetIQ Advance Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HCVE-2024-44795 · Other software · gazelle_project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
- Product
- gazelle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path.CVE-2024-39097 · Other software · gnuboard · reported by MITREMedium 6.1
There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path.
- Product
- gnuboard6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 20, 2024School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.phpCVE-2024-42566 · Other software · school_management_system_project · reported by MITRECritical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php
- Product
- school_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid passwordCVE-2024-42559 · Other software · hotel_management_system_project · reported by MITRECritical 9.8
An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid password.
- Product
- hotel_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2024Login As Users: Improper Privilege ManagementCVE-2024-43311 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4.2.
- Product
- Login As Users
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login pCVE-2024-42657 · Other software · nepstech · reported by MITREHigh 7.5
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process
- Product
- ntpl-xpon1gfevn_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Aug 17, 2024LOGIN AND REGISTRATION ATTEMPTS LIMIT: IP Address SpoofingCVE-2022-4532 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
- Product
- LOGIN AND REGISTRATION ATTEMPTS LIMIT
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update LOGIN AND REGISTRATION ATTEMPTS LIMIT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2024Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.CVE-2024-43042 · Other software · Pluck-cms · reported by MITRECritical 9.8
Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.
- Product
- Pluck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 16, 2024A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier.CVE-2024-43009 · Other software · zzcms · reported by MITREMedium 4.7
A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Theme My Login: Cross-Site Request ForgeryCVE-2024-7422 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.
- Product
- Theme My Login
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 13, 2024This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the wCVE-2024-2259 · Other software · Meddiff Technologies · reported by vdisclose@cert-in.org.inMedium 6.4
This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerable parameter to perform reflected Cross Site Scripting (XSS) attacks on the targeted system.
- Product
- InstaRISPACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024In SAP Commerce, valid user accounts can be identified during the customer registration and login processes.CVE-2024-41733 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 5.3
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.CVE-2024-42547 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
- Product
- a3100r
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.CVE-2024-42546 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.
- Product
- a3100r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.CVE-2024-42543 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
- Product
- a3700r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-7503 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.