Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,374 results · page 22 of 48

Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Product
POST SMTP Mailer
Fixed in
2.7.1
What to do
Update POST SMTP Mailer to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2023SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modifieCVE-2023-33706 · Other software · Sysaid · reported by MITREMedium 6.5
SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp.
Product
Sysaid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.pridesec.com.br blog.pridesec.com.br
Nov 23, 2023Email Marketing for WooCommerce by Omnisend: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
Product
Email Marketing for WooCommerce by Omnisend
Affected
up to 1.13.8
What to do
Affects up to 1.13.8. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.CVE-2023-47821 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 21, 2023Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email and Address parameters in the Register CVE-2023-48124 · Other software · Nayem-howlader · reported by MITREMedium 5.4
Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email and Address parameters in the Register New Account component.
Product
SUP Online Shopping
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record patelvarshil.medium.com sourcecodester.com
Nov 17, 2023AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-47757 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.
Product
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth
Affected
up to 7.3.9
What to do
Affects up to 7.3.9. Update AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 14, 2023SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the regiCVE-2023-46581 · Other software · Code-projects · reported by MITREMedium 5.5
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component.
Product
Inventory Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versCVE-2023-31086 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions.
Fixed in
2.46.1
What to do
Update the plugin to 2.46.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Email Templates Customizer and Designer for WordPress and WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2022-47181 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
Product
Email Templates Customizer and Designer for WordPress and WooCommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Email Templates Customizer and Designer for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Product
Emails & Newsletters with Jackmail
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
Product
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Commenter Emails: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45360 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.
Product
Commenter Emails
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Commenter Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.CVE-2023-42553 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.
Product
Samsung Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Nov 7, 2023Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers CVE-2023-42547 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Product
Samsung Account
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.CVE-2023-47186 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.
Affected
up to 1.5.11
What to do
Affects up to 1.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023WP Reroute Email: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-27605 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This issue affects WP Reroute Email: from n/a through 1.4.6.
Product
WP Reroute Email
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update WP Reroute Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Email posts to subscribers: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-46818 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.
Product
Email posts to subscribers
Affected
up to 6.2
What to do
Affects up to 6.2. Update Email posts to subscribers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or CVE-2023-41259 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
Product
request_tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.bestpractical.com docs.bestpractical.com
Oct 26, 2023The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.CVE-2023-46754 · Other software · Obl.ong · reported by MITREMedium 5.3
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.
Product
Admin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 25, 2023ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.CVE-2023-39619 · Other software · Teomantuncer · reported by MITREHigh 7.5
ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.
Product
Node Email Check
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Oct 20, 2023WP Mailto Links – Protect Email Addresses: Stored Cross-Site ScriptingCVE-2023-5109 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4.
Product
WP Mailto Links – Protect Email Addresses
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update WP Mailto Links – Protect Email Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2023A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version CVE-2023-5552 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 7.1
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.
Product
Sophos Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sophos.com sophos.com
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com
Oct 16, 2023Nextcloud mail is an email app for the Nextcloud home server platform.CVE-2023-45660 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch – Grow your Email List plugin <= 3.1.2 versions.CVE-2023-41852 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch – Grow your Email List plugin <= 3.1.2 versions.
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.temCVE-2023-45303 · Other software · Thingsboard · reported by MITREHigh 8.4
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
Product
Thingsboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record freemarker.apache.org herolab.usd.de
Sep 28, 2023The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44164 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Movie Ticket Booking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Sep 28, 2023Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.CVE-2023-4316 · Other software · Zod · reported by help@fluidattacks.comHigh 7.5
Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.
Product
Zod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com npmjs.com
Sep 28, 2023Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an externalCVE-2023-43013 · Other software · Asset Management System · reported by help@fluidattacks.comCritical 9.8
Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
Product
Asset Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Sep 19, 2023Super Store Finder: Unauthenticated arbitrary email creation and relayCVE-2023-5054 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.
Product
Super Store Finder
Affected
up to 6.9.3
What to do
Affects up to 6.9.3. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record superstorefinder.net superstorefinder.net
Sep 11, 2023This issue was addressed with improved state management of S/MIME encrypted emails.CVE-2023-40440 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in macOS Monterey 12.6.8. A S/MIME encrypted email may be inadvertently sent unencrypted.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.aegrel.ee support.apple.com
Sep 9, 2023Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12CVE-2023-4874 · Other software · Mutt · reported by cve@gitlab.comMedium 4.3
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12
Product
Mutt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Sep 6, 2023Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive informatiCVE-2023-30729 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.1
Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information.
Product
Samsung Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Sep 5, 2023Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php.CVE-2023-39681 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
Product
Cuppacms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 31, 2023Woo Custom Emails: Reflected Cross-Site ScriptingCVE-2023-4315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-45004 appears to be a duplicate of this issue.
Product
Woo Custom Emails
Affected
up to 2.2
What to do
Affects up to 2.2. Update Woo Custom Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2023Email Encoder: Stored Cross-Site ScriptingCVE-2023-4599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was issued in version 2.1.8. The vulnerability was fully patched in 2.1.9.
Product
Email Encoder
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Email Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2023In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take oCVE-2023-40754 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Product
CAR Rental Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 25, 2023Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.CVE-2023-32678 · Other software · zulip · reported by GitHubMedium 6.5
Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that they used to have access to, if other relevant organization permissions allow these actions. For example, a user may be able to edit or delete their old messages they posted in such a private stream. An administrator will be able to delete old messages (that they had access to) from the private stream. This issue was fixed in Zulip Server version 7.3.
Product
zulip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com zulip.readthedocs.io
Aug 14, 2023WP-EMail: Does not sanitise and escape some of its settingsCVE-2023-3721 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP-EMail
Fixed in
2.69.1
What to do
Update WP-EMail to 2.69.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 10, 2023There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.CVE-2023-36314 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
Product
Callback Widget
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 9, 2023A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dCVE-2022-48594 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Aug 7, 2023Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilCVE-2023-38932 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function.
Product
f1202
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com netgear.com
Aug 4, 2023A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2020-26082 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected zip files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 3, 2023In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers CVE-2023-36139 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Product
Cleaning Business Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 3, 2023In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers toCVE-2023-36134 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Product
Class Scheduling System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Aug 1, 2023In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackeCVE-2023-33563 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
Product
Time Slots Booking Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Jul 31, 2023Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.CVE-2023-37772 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.
Product
Online Shopping Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record phpgurukul.com github.com
Jul 31, 2023A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute aCVE-2023-35861 · Other software · supermicro · reported by MITRECritical 9.8
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
Product
h12dst-b
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.freax13.de supermicro.com
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions.CVE-2023-27606 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions.
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controCVE-2023-37960 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.
Product
Jenkins MathWorks Polyspace Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.