Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,712 results · page 23 of 35
Oct 14, 2022In soundrecorder service, there is a missing permission check.CVE-2022-38670 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In soundrecorder service, there is a missing permission check.CVE-2022-38669 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php.CVE-2022-41534 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.CVE-2022-41408 · Other software · Online PET Shop WE App Project · reported by MITRECritical 9.8
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
- Product
- Online PET Shop WE App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.CVE-2022-41407 · Other software · Online PET Shop WE App Project · reported by MITREHigh 7.2
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
- Product
- Online PET Shop WE App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path.CVE-2022-33748 · Other software · Xen · reported by security@xen.orgMedium 5.6
lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Sep 28, 2022Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.CVE-2021-45788 · Other software · Metersphere · reported by MITREHigh 8.8
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
- Product
- Metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id.CVE-2022-40933 · Other software · Online PET Shop Web Application Project · reported by MITREHigh 7.2
Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id.
- Product
- Online PET Shop Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-40978 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Sep 14, 2022An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to creatCVE-2022-40626 · Other software · Zabbix · reported by security@zabbix.comMedium 4.8
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsupport.zabbix.com
Sep 13, 2022An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corrCVE-2022-34831 · Other software · Primekey · reported by MITRECritical 9.8
An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.keyfactor.comprimekey.com
Sep 9, 2022Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPressCVE-2022-35275 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 2, 2022An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to access data for all existing orders.CVE-2022-36638 · Other software · Garage Management System Project · reported by MITREMedium 5.3
An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to access data for all existing orders.
- Product
- Garage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsenzee.netsourcecodester.com
Sep 2, 2022Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon ComCVE-2021-35113 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.3
Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 2, 2022Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon ComCVE-2021-35097 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.3
Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 1, 2022Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.CVE-2022-36759 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.CVE-2022-36581 · Other software · Online Ordering System Project · reported by MITREHigh 7.5
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute aCVE-2022-36580 · Other software · Online Ordering System Project · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2022A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System.CVE-2022-3015 · Other software · oretnom23 · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the file admin/?page=reports. The manipulation of the argument date leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-207425 was assigned to this vulnerability.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2022A vulnerability was found in oretnom23 Fast Food Ordering System.CVE-2022-3012 · Other software · oretnom23 · reported by VulDBMedium 6.3
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-207422 is the identifier assigned to this vulnerability.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 anCVE-2022-35733 · Other software · UNIMO Technology Co., Ltd · reported by vultures@jpcert.or.jpCritical 9.8
Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 and earlier, and UDR-JA1016 firmware versions v2.0.20.13 and earlier) allows a remote unauthenticated attacker to execute an arbitrary OS command by sending a specially crafted request to the affected device web interface.
- Product
- UNIMO Technology digital video recorders UDR-JA1004/JA1008/JA1016 and UDR-JA1016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2022Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.CVE-2022-36605 · Other software · Yimihome · reported by MITRECritical 9.8
Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.
- Product
- Ywoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters.CVE-2022-35976 · Other software · weaveworks · reported by GitHubMedium 5.2
The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or users are affected by this issue. Please note that the vulnerability is specific to this extension, and the same kubeconfig would not result in arbitrary code execution when used with kubectl. Using only trust-worthy kubeconfigs is a safe mitigation. However, updating to the latest version of the extension is still highly recommended.
- Product
- vscode-gitops-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.CVE-2020-1755 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2022A vulnerability, which was classified as problematic, was found in oretnom23 Fast Food Ordering System.CVE-2022-2686 · Other software · oretnom23 · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in oretnom23 Fast Food Ordering System. This affects an unknown part of the component Menu List Page. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205725 was assigned to this vulnerability.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php.CVE-2022-34953 · Websites & servers · Phptpoint · reported by MITRECritical 9.8
Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 anCVE-2021-42755 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below, 6.2.10 and below, 6.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service.
- Product
- Fortinet FortiSwitch, FortiRecorder, FortiVoiceEnterprise, FortiOS, FortiProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jul 14, 2022Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=saveCVE-2022-32318 · Other software · Fast Food Ordering System Project · reported by MITREMedium 5.4
Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=save_category.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 6, 2022IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in orCVE-2022-24140 · Other software · Iobit · reported by MITREMedium 6.6
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.
- Product
- Advanced System Care
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.CVE-2022-32095 · Other software · Hospital Management System Project · reported by MITRECritical 9.8
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.CVE-2022-33119 · Other software · Nuuo · reported by MITREMedium 6.1
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
- Product
- Nvrsolo Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.CVE-2022-31801 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- Product
- MULTIPROG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 21, 2022An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.CVE-2022-31800 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- Product
- ILC 1x0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 17, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.CVE-2022-31357 · Other software · Online Ordering System Project · reported by MITRECritical 9.8
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.CVE-2022-31356 · Other software · Online Ordering System Project · reported by MITRECritical 9.8
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.CVE-2022-31355 · Other software · Online Ordering System Project · reported by MITRECritical 9.8
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=.CVE-2022-32353 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/manage_menu.php?id=.CVE-2022-32335 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/manage_menu.php?id=.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/manage_category.php?id=.CVE-2022-32334 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/manage_category.php?id=.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=.CVE-2022-32333 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_category.CVE-2022-32332 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_category.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/view_category.php?id=.CVE-2022-32331 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/view_category.php?id=.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_menu.CVE-2022-32330 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.2
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_menu.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to Delete any file.CVE-2022-32328 · Other software · Fast Food Ordering System Project · reported by MITRECritical 9.1
Fast Food Ordering System v1.0 is vulnerable to Delete any file. via /ffos/classes/Master.php?f=delete_img.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view_menu.php?id=.CVE-2022-32336 · Other software · Fast Food Ordering System Project · reported by MITRECritical 9.8
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view_menu.php?id=.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and earlier, THERMO RECCVE-2022-29509 · Other software · T&D Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and earlier, THERMO RECORDER DATA SERVER (Japanese Edition) Ver.2.13 and earlier, and THERMO RECORDER DATA SERVER (English Edition) Ver.2.13 and earlier allows a remote attacker to view an arbitrary file on the server via unspecified vectors.
- Product
- T&D Data Server and THERMO RECORDER DATA SERVER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 8, 2022CP Image Store with Slideshow: Does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embedCVE-2022-1692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
- Product
- CP Image Store with Slideshow
- Fixed in
- 1.0.68
- What to do
- Update CP Image Store with Slideshow to 1.0.68 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.