Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

3,618 results · page 24 of 73

Apr 17, 2024It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.CVE-2023-4509 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Apr 17, 2024A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages.CVE-2024-1249 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
Product
Red Hat AMQ Broker 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Apr 17, 2024A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU).CVE-2023-40146 · Other software · Peplink · reported by talos-cna@cisco.comMedium 6.8
A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this vulnerability.
Product
Smart Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.peplink.com talosintelligence.com
Apr 17, 2024Theme My Login: Missing AuthorizationCVE-2024-32525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
Product
Theme My Login
Affected
up to 7.1.6
What to do
Affects up to 7.1.6. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Login With Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1.
Product
Login With Ajax
Affected
up to 4.1
What to do
Affects up to 4.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2024-31923 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page.This issue affects Feather Login Page: from n/a through 1.1.5.
Product
Feather Login Page
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Login with phone number: Cross-Site Request Forgery (CSRF)CVE-2024-31424 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
Product
Login with phone number
Affected
up to 1.6.93
What to do
Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Change default login logo,url and title: Cross-Site Request Forgery (CSRF)CVE-2024-31086 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting (XSS).This issue affects Change default login logo,url and title: from n/a through 2.0.
Product
Change default login logo,url and title
Affected
up to 2.0
What to do
Affects up to 2.0. Update Change default login logo,url and title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.64
What to do
Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024The parameter used in the login page of Netvision airPASS is not properly filtered for user input.CVE-2024-3776 · Other software · Netvision · reported by twcert@cert.org.twMedium 6.1
The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.
Product
airPASS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Apr 11, 2024Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted link to /login/ in the CVE-2024-27592 · Other software · Corezoid · reported by MITREMedium 4.3
Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted link to /login/ in the login page URL.
Product
Corezoid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com medium.com
Apr 11, 2024WP Login and Logout Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31927 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aminur Islam WP Login and Logout Redirect allows Stored XSS.This issue affects WP Login and Logout Redirect: from n/a through 1.2.
Product
WP Login and Logout Redirect
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Login and Logout Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-3210 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'reg-single-checkbox' shortcode in all versions up to, and including, 4.15.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.5
What to do
Affects up to 4.15.5. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Stored Cross-Site ScriptingCVE-2024-2423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Privilege escalationCVE-2024-1991 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.0.0
What to do
Affects up to 5.3.0.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Blind SQL InjectionCVE-2024-1990 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.1.0
What to do
Affects up to 5.3.1.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2024TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.CVE-2024-31814 · Other software · totolink · reported by MITREHigh 8.8
TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
Product
ex200_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 8, 2024AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page.CVE-2022-43216 · Other software · abrhil · reported by MITRECritical 9.1
AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page.
Product
employees_portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abrhil.com github.com
Apr 7, 2024Easy Login Styler – White Label Admin Login Page for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.
Product
Easy Login Styler – White Label Admin Login Page for
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Easy Login Styler – White Label Admin Login Page for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.CVE-2024-28741 · Other software · engindemirbilek · reported by MITREHigh 8.8
Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.
Product
northstarc2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.chebuya.com github.com
Apr 2, 2024Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through queCVE-2024-2745 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244.
Product
InsightVM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.rapid7.com docs.rapid7.com
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.CVE-2024-30865 · Other software · netentsec · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.
Product
ns-asg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.CVE-2024-30868 · Other software · netentsec · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.
Product
ns-asg_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 29, 2024A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py.CVE-2024-1729 · Other software · gradio-app · reported by security@huntr.devMedium 5.9
A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.
Product
gradio-app/gradio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 28, 2024In JetBrains TeamCity before 2024.03 open redirect was possible on the login pageCVE-2024-31135 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Mar 27, 2024ZITADEL, open source authentication management software, uses Go templates to render the login UI.CVE-2024-29892 · Other software · zitadel · reported by GitHubMedium 6.1
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
Product
zitadel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2024Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login boCVE-2024-29644 · Other software · Dcatadmin · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.
Product
Dcat Admin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com yuque.com
Mar 22, 2024Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.CVE-2024-29865 · Other software · Logpoint · reported by MITREMedium 5.4
Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.
Product
Siem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record servicedesk.logpoint.com servicedesk.logpoint.com
Mar 19, 2024Passwordless Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29143 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.
Product
Passwordless Login
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024ZITADEL, open source authentication management software, uses Go templates to render the login UI.CVE-2024-28855 · Other software · zitadel · reported by GitHubHigh 8.1
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.
Product
zitadel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 18, 2024An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to reCVE-2024-25657 · Other software · avsystem · reported by MITREMedium 5.4
An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to redirect authenticated users to malicious websites.
Product
unified_management_platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cvcn.gov.it cvcn.gov.it
Mar 18, 2024BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all CVE-2024-1605 · Other software · BMC · reported by cvd@cert.plMedium 6.6
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Product
Control-M
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Mar 14, 2024A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php.CVE-2024-26454 · Other software · reported by MITREMedium 5.4
A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com medium.com
Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1806 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.1
What to do
Affects up to 4.15.1. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Wp Social Login and Register Social Counter: Unauthorized modification of dataCVE-2024-1763 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to enable and disable certain providers for the social share and login features.
Product
Wp Social Login and Register Social Counter
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1535 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.2
What to do
Affects up to 4.15.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1409 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [reg-select-role] shortcode in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.0
What to do
Affects up to 4.15.0. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: SQL InjectionCVE-2024-1071 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
2.1.3 to 2.8.2
What to do
Affects 2.1.3 to 2.8.2. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-2123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2024A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie.CVE-2024-28338 · Other software · totolink · reported by MITREHigh 8
A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie.
Product
a8000ru_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 11, 2024Login as User or Customer: Does not prevent users to log inCVE-2023-7247 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
Product
Login as User or Customer
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.google.com wpscan.com
Mar 10, 2024Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.CVE-2024-28816 · Other software · aaravrajsingh · reported by MITREHigh 7.1
Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.
Product
chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2024A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-2265 · Other software · keerti1924 · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256035. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
PHP-MYSQL-User-Login-System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 7, 2024A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-2264 · Other software · keerti1924 · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256034 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
PHP-MYSQL-User-Login-System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 7, 2024Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.CVE-2023-41503 · Websites & servers · php · reported by MITRECritical 9.8
Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.
Product
student_enrollment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Stored Cross-Site ScriptingCVE-2024-1720 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2024This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component.CVE-2024-25102 · Other software · CDAC · reported by vdisclose@cert-in.org.inHigh 7.8
This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted system. Successful exploitation of this vulnerability could allow the attacker to take complete control of the application on the targeted system.
Product
AppSamvid Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in cert-in.org.in
Mar 6, 2024This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component.CVE-2024-1224 · Other software · CDAC · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of USB Pratirodh on the targeted system. Successful exploitation of this vulnerability could allow the attacker to take control of the application and modify the access control of registered users or devices on the targeted system.
Product
USB Pratirodh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in cert-in.org.in
Mar 4, 2024Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.CVE-2023-49547 · Other software · sourcecodester · reported by MITRECritical 9.8
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.
Product
customer_support_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Mar 2, 2024Nextend Social Login and Register: A self-based Reflected Cross-Site ScriptingCVE-2024-1775 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, with access to a subscriber-level account, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: This vulnerability can be successfully exploited on a vulnerable WordPress instance against an OAuth pre-authenticated higher-level user (e.g., administrator) by leveraging a cross-site request forgery in conjunction with a certain social engineering technique to achieve a critical impact scenario (cross-site scripting to administrator-level account creation). However, successful exploitation requires "Debug mode" to be enabled in the plugin's "Global Settings".
Product
Nextend Social Login and Register
Affected
up to 3.1.12
What to do
Affects up to 3.1.12. Update Nextend Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.