Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 26 of 73
Dec 18, 2023WooCommerce Login Redirect: Cross-Site Request Forgery (CSRF)CVE-2023-48773 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
- Product
- WooCommerce Login Redirect
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WooCommerce Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Theme My Login 2FA: Does not rate limit 2FA validation attemptsCVE-2023-6272 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
- Product
- Theme My Login 2FA
- Fixed in
- 1.2
- What to do
- Update Theme My Login 2FA to 1.2 or newer.
Dec 18, 2023Disable User Login: Cross-Site Request Forgery (CSRF)CVE-2023-47806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
- Product
- Disable User Login
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023In JetBrains TeamCity before 2023.11.1 a CSRF on login was possibleCVE-2023-50870 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 13, 2023Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowingCVE-2023-50771 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 11, 2023Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privilegCVE-2023-36651 · Other software · Prolion · reported by MITREHigh 7.2
Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials.
- Product
- Cryptospike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Not Login Hide (WPNLH)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2023The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.CVE-2023-28874 · Other software · Seafile · reported by MITREMedium 6.1
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Dec 7, 2023Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prioCVE-2023-4486 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.5
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to versions 11.0.6 and 12.0.4 and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
- Product
- Metasys NAE55/SNE/SNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 6, 2023The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain aCVE-2023-36655 · Other software · Prolion · reported by MITRECritical 9.8
The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination.
- Product
- Cryptospike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprolion.comcvcn.gov.it
Dec 3, 2023Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.CVE-2023-49947 · Other software · Forgejo · reported by MITREHigh 7.5
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
- Product
- Forgejo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orgforgejo.org
Nov 30, 2023Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldCVE-2023-6342 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable "pay for print" feature was removed on or around 2023-11-01.
- Product
- Court Case Management Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtechcrunch.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
- Product
- Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.13.2
- What to do
- Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Cross-Site Request Forgery (CSRF)CVE-2023-47645 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Cross Site Request Forgery.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.2.6.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 5.2.2.6
- What to do
- Affects up to 5.2.2.6. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthCVE-2023-49620 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Nov 27, 2023An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template managemCVE-2023-47503 · Other software · Jflyfox · reported by MITRECritical 9.8
An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.CVE-2023-5885 · Other software · Franklin Electric Fueling Systems · reported by ics-cert@hq.dhs.govMedium 6.5
The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.
- Product
- Colibri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govfranklinfueling.com
Nov 27, 2023Limit Login Attempts Reloaded: Is missing authorization on the `toggle_auto_update` AJAX actionCVE-2023-5525 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
- Product
- Limit Login Attempts Reloaded
- Fixed in
- 2.25.26
- What to do
- Update Limit Login Attempts Reloaded to 2.25.26 or newer.
Nov 22, 2023Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries.CVE-2023-47312 · Other software · H-mdm · reported by MITREMedium 6.5
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries.
- Product
- Headwind MDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordboltonshield.comboltonshield.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Yoohoo Plugins When Last Login plugin <= 1.2.1 versions.CVE-2023-27461 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yoohoo Plugins When Last Login plugin <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2023Easy Hide Login: Cross-Site Request Forgery (CSRF)CVE-2023-31075 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8.
- Product
- Easy Hide Login
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Easy Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 13, 2023The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids.CVE-2023-42480 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.
- Product
- NetWeaver AS Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Auto Login New User After Registration: Cross-Site Request Forgery (CSRF)CVE-2023-46201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration allows Stored XSS.This issue affects Auto Login New User After Registration: from n/a through 1.9.6.
- Product
- Auto Login New User After Registration
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Auto Login New User After Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.CVE-2023-34025 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.CVE-2023-46777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <= 3.5.2 versCVE-2023-47182 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <= 3.5.2 versions.
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 4, 2023LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.CVE-2023-46382 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.
- Product
- Linx-212 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 31, 2023Login Screen Manager: Does not sanitize and escape some of its settingsCVE-2023-5243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login Screen Manager
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Login Screen Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2023TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.CVE-2023-46978 · Other software · totolink · reported by MITREHigh 7.5
TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.CVE-2023-46977 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.
- Product
- lr1200gb_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.CVE-2023-46525 · Network & remote access · tp-link · reported by MITRECritical 9.8
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.
- Product
- tl-wr886n_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresource.tp-link.com.cn
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions.CVE-2023-46202 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions.
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.CVE-2023-26573 · Other software · IDAttend Pty Ltd · reported by vdp@themissinglink.com.auHigh 8.2
Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.
- Product
- IDWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 23, 2023UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.CVE-2023-37635 · Other software · Uvdesk · reported by MITRECritical 9.8
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
- Product
- Community-skeleton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Oct 19, 2023 In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.CVE-2023-40145 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 8.8
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
- Product
- cMT-FHD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.weintek.comcisa.gov
Oct 18, 2023An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password.CVE-2023-45911 · Other software · wipotec · reported by MITRECritical 9.8
An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password.
- Product
- comscale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Defender Security: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2023-5089 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
- Product
- Defender Security
- Fixed in
- 4.1.0
- What to do
- Update Defender Security to 4.1.0 or newer.
Full record and what to do →NVD recordwpscan.comsprocketsecurity.com
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
- Product
- DoLogin Security
- Fixed in
- 3.7.1
- What to do
- Update DoLogin Security to 3.7.1 or newer.
Oct 16, 2023In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.CVE-2023-29484 · Other software · Terminalfour · reported by MITREMedium 6.5
In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.
- Product
- Terminalfour
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.terminalfour.comdocs.terminalfour.com
Oct 16, 2023TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.CVE-2023-36340 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
- Product
- nr1800x_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions.CVE-2023-44995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 9, 2023hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.CVE-2023-43899 · Other software · Hansuncms Project · reported by MITRECritical 9.8
hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.
- Product
- Hansuncms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 5, 2023SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to executCVE-2023-44024 · Other software · Knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
- Product
- ONE Page Checkout, Social Login & Mailchimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00CVE-2023-40519 · Other software · Broadpeak · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575_ee9195b0, 01.01.01.30097902_fd999e76, and 00.12.01.9565588_1254b459 allows remote attackers to inject arbitrary web script or HTML via the disconnectMessage parameter.
- Product
- Centralized Accounts Management Auth Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administCVE-2023-3196 · Other software · Capensis · reported by cve-coordination@incibe.esMedium 4.7
This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel.
- Product
- Canopsis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.canopsis.netgit.canopsis.net
Oct 3, 2023QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so.CVE-2023-4102 · Other software · IDM Sistemas QSige · reported by cve-coordination@incibe.esHigh 8.8
QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so.CVE-2023-4101 · Other software · IDM Sistemas QSige · reported by cve-coordination@incibe.esHigh 8.8
The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44164 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.CVE-2023-43860 · Other software · dlink · reported by MITREHigh 7.5
D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.
- Product
- dir-619l
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities.CVE-2023-38871 · Other software · Economizzer · reported by MITREMedium 5.3
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.
- Product
- Economizzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.