Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,618 results · page 25 of 73
Mar 1, 2024Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by chanCVE-2024-25064 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 4.3
Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values.
- Product
- HikCentral Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhikvision.comhikvision.com
Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1570 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login-password shortcode in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.14.4
- What to do
- Affects up to 4.14.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1519 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a member listing page to be active and using the Gerbera theme.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.14.4
- What to do
- Affects up to 4.14.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code InjectionCVE-2024-1470 · Other software · OpenText · reported by security@opentext.comHigh 7.1
Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue only affects NetIQ Client Login Extension: 4.6.
- Product
- NetIQ Client Login Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1408 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edit-profile-text-box shortcode in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping on user supplied attributes such as 'type'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.14.4
- What to do
- Affects up to 4.14.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 28, 2024Login Lockdown – Protect Login Form: Unauthorized access of dataCVE-2024-1340 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
- Product
- Login Lockdown – Protect Login Form
- Affected
- up to 2.08
- What to do
- Affects up to 2.08. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1861 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Affected
- up to 4.52
- What to do
- Affects up to 4.52. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1860 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Affected
- up to 4.51
- What to do
- Affects up to 4.51. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2024A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical.CVE-2024-1702 · Other software · keerti1924 · reported by VulDBMedium 6.3
A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /edit.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical.CVE-2024-1701 · Other software · keerti1924 · reported by VulDBMedium 5.3
A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-1700 · Other software · keerti1924 · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input <script>alert("xss")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.CVE-2024-26318 · Other software · Serenity · reported by MITREMedium 6.1
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
- Product
- Serenity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordserenity.isserenity.is
Feb 16, 2024Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO).CVE-2024-20915 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
- Product
- Application Object Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login.CVE-2024-26264 · Other software · EBM Technologies · reported by twcert@cert.org.twCritical 9.8
EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
- Product
- RISWEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 12, 2024Web3: Is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'CVE-2023-6036 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Web3
- Fixed in
- 3.0.0
- What to do
- Update Web3 to 3.0.0 or newer.
Feb 10, 2024Heateor Social Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24712 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login WordPress allows Stored XSS.This issue affects Heateor Social Login WordPress: from n/a through 1.1.30.
- Product
- Heateor Social Login
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 7, 2024Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.CVE-2024-24133 · Other software · atmail · reported by MITRECritical 9.8
Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
- Product
- atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.CVE-2024-24291 · Other software · Yzmcms · reported by MITREMedium 6.1
An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dirCVE-2024-22365 · Other software · Siemens · reported by MITREMedium 5.5
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
- Product
- RUGGEDCOM ROX MX5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 5, 2024Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.CVE-2024-22773 · Other software · Intelbras · reported by MITREHigh 8.1
Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.
- Product
- Action RF 1200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comintelbras.com
Feb 5, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'reg-number-field' shortcode in all versions up to, and including, 4.14.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.14.3
- What to do
- Affects up to 4.14.3. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.CVE-2024-21794 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 5.4
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Reflected XSS.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.1.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 5.2.4.1
- What to do
- Affects up to 5.2.4.1. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 25, 2024NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.CVE-2024-22729 · Other software · Netis-systems · reported by MITRECritical 9.8
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
- Product
- Mw5360 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.CVE-2024-22497 · Other software · Jfinalcms Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
- Product
- Jfinalcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.CVE-2024-22496 · Other software · Jfinalcms Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
- Product
- Jfinalcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024Wp Social Login and Register Social Counter: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47160 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Login and Register Social Counter: from n/a through 1.9.0.
- Product
- Wp Social Login and Register Social Counter
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 19, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Deserialization of Untrusted DataCVE-2022-45083 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2024A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the loCVE-2023-48858 · Other software · Abocms · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part.
- Product
- Abo.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024WIP Custom Login: Missing AuthorizationCVE-2022-42884 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.
- Product
- WIP Custom Login
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WIP Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2024kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.CVE-2023-52068 · Other software · Kodcloud · reported by MITREMedium 6.1
kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Jan 12, 2024Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts.CVE-2023-49801 · Other software · Lif-Platforms · reported by GitHubMedium 4.2
Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
- Product
- Lif-Auth-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024The "tokenKey" value used in user authorization is visible in the HTML source of the login page.CVE-2023-49261 · Other software · Hongdian · reported by cvd@cert.plHigh 7.5
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- Product
- H8951-4G-ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.CVE-2023-51987 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.
- Product
- Dir-822 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Limit Login Attempts Reloaded: Stored Cross-Site ScriptingCVE-2023-6934 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Limit Login Attempts Reloaded
- Affected
- up to 2.25.26
- What to do
- Affects up to 2.25.26. Update Limit Login Attempts Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Jan 10, 2024Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.CVE-2022-40361 · Other software · Elitecms · reported by MITREMedium 6.1
Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelitecrm.cohazemhussien99.wordpress.com
Jan 10, 2024A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.CVE-2023-49810 · Other software · WWBN · reported by talos-cna@cisco.comHigh 7.3
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 10, 2024A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA.CVE-2023-5455 · Other software · Red Hat · reported by Red HatMedium 6.5
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 9, 2024In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX pCVE-2023-50974 · Other software · Appwrite · reported by MITREMedium 5.5
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
- Product
- Command Line Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappwrite.iogist.github.com
Jan 8, 2024TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.CVE-2023-27098 · Network & remote access · Tp-link · reported by MITREHigh 7.5
TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.
- Product
- Tapo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- Product
- Defender Security – Malware Scanner, Login Security & Firewall
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 5, 2024White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: Cross-Site Request Forgery (CSRF)CVE-2023-52128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.
- Product
- White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 30, 2023Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.CVE-2023-50589 · Other software · Embras · reported by MITRECritical 9.8
Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.
- Product
- Geosiap ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
Dec 29, 2023Login Lockdown – Protect Login Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50837 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.
- Product
- Login Lockdown – Protect Login Form
- Affected
- up to 2.06
- What to do
- Affects up to 2.06. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50846 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 5.2.4.5
- What to do
- Affects up to 5.2.4.5. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Cross-Site Request Forgery (CSRF)CVE-2023-50858 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Affected
- up to 4.34
- What to do
- Affects up to 4.34. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.CVE-2023-50986 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
- Product
- i29_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023Login and Logout Redirect: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-41648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.
- Product
- Login and Logout Redirect
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Login and Logout Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooCommerce Login Redirect: Cross-Site Request Forgery (CSRF)CVE-2023-48773 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
- Product
- WooCommerce Login Redirect
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WooCommerce Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Theme My Login 2FA: Does not rate limit 2FA validation attemptsCVE-2023-6272 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
- Product
- Theme My Login 2FA
- Fixed in
- 1.2
- What to do
- Update Theme My Login 2FA to 1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.