Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,730 results · page 27 of 35

Oct 2, 2020Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.CVE-2020-26135 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
Product
Live Helper Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 2, 2020Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.CVE-2020-26134 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
Product
Live Helper Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 10, 2020Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.CVE-2020-24582 · Other software · Zulipchat · reported by MITREMedium 6.1
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.
Product
Zulip Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.com blog.zulip.com
Sep 3, 2020Enghouse Web Chat 6.2.284.34 allows XSS.CVE-2020-13972 · Other software · Enghouse · reported by MITREMedium 6.1
Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.
Product
Web Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record burninatorsec.blogspot.com burninatorsec.blogspot.com
Aug 27, 2020Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.CVE-2020-23576 · Other software · Laborator · reported by MITREMedium 5.4
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
Product
Neon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vimeo.com vimeo.com
Aug 27, 2020Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.CVE-2020-23983 · Other software · Ichat Project · reported by MITREMedium 5.4
Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
Product
Ichat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 27, 2020Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (allCVE-2020-23974 · Other software · Create-project Manager Project · reported by MITREMedium 5.4
Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).
Product
Create-project Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Aug 26, 2020A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notifiCVE-2020-12456 · Email & office · Mitel · reported by MITREHigh 8.8
A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform directory traversal, and execute arbitrary scripts in the context of the Connect client.
Product
Mivoice Connect Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mitel.com mitel.com
Aug 18, 2020Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in rCVE-2020-15926 · Other software · Rocket.chat · reported by MITREMedium 6.1
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
Product
Rocket.chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.redteam.pl github.com
Aug 11, 2020Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat CVE-2020-17448 · Other software · Telegram · reported by MITREHigh 7.8
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Product
Telegram Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 9, 2020Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerCVE-2020-12637 · Other software · Zulipchat · reported by MITRECritical 9.8
Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.
Product
Zulip Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.org blog.zulip.org
Apr 22, 2020JetBrains Space through 2020-04-22 allows stored XSS in Chats.CVE-2020-11416 · Other software · Jetbrains · reported by MITREMedium 5.4
JetBrains Space through 2020-04-22 allows stored XSS in Chats.
Product
Space
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.jetbrains.com blog.jetbrains.com
Mar 23, 2020An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected).CVE-2020-9760 · Other software · Weechat · reported by MITRECritical 9.8
An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.
Product
Weechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Mar 23, 2020In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history.CVE-2020-8497 · Other software · Artica · reported by MITREMedium 5.3
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.
Product
Pandora FMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record k4m1ll0.com k4m1ll0.com
Mar 20, 2020The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.CVE-2019-12498 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
Product
WP Live Chat Support
Fixed in
8.0.33
What to do
Update WP Live Chat Support to 8.0.33 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 18, 2020Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways.CVE-2020-9443 · Other software · Zulipchat · reported by MITREMedium 6.1
Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.
Product
Zulip Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zulip.org blog.zulip.org
Mar 9, 2020An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk).CVE-2020-9758 · Other software · Livezilla · reported by MITRECritical 9.6
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.
Product
Livezilla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 5, 2020An issue was discovered in EFS Easy Chat Server 3.1.CVE-2019-20502 · Other software · Echatserver · reported by MITREHigh 7.5
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.
Product
Easy Chat Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2020Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (CVE-2012-0828 · Other software · xchat · reported by Red HatCritical 9.8
Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).
Product
Xchat-WDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com access.redhat.com
Feb 18, 2020phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.CVE-2020-9265 · Other software · Ciprianmp · reported by MITREHigh 8.2
phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.
Product
Phpmychat-plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 12, 2020An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6.CVE-2018-3987 · Other software · Rakuten · reported by talos-cna@cisco.comMedium 5.5
An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allows a user to delete all traces of a chat either by using a time trigger or by direct request. There is a bug in this functionality which leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
Product
Viber
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Feb 12, 2020irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application cCVE-2020-8955 · Other software · Weechat · reported by MITRECritical 9.8
irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).
Product
Weechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org github.com
Jan 30, 2020Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.CVE-2013-0739 · Other software · Chamilo · reported by PSIRT-CNA@flexerasoftware.comMedium 6.1
Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
Product
Chamilo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 21, 2020The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.CVE-2020-7239 · WordPress plugins & themes · reported by MITREMedium 6.1
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
Product
conversation-watson
Fixed in
0.8.21
What to do
Update conversation-watson to 0.8.21 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jan 15, 2020Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.CVE-2015-7874 · Other software · Portapps · reported by MITRECritical 9.8
Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.
Product
Kitty Portable
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message CVE-2019-20212 · WordPress plugins & themes · reported by MITREMedium 6.1
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
Fixed in
2.3.4
What to do
Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jan 7, 2020This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9.CVE-2019-17151 · Other software · Tencent · reported by zdi-disclosures@trendmicro.comMedium 5.4
This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to exploit this vulnerability in that the target must be within a chat session together with the attacker. The specific flaw exists within the parsing of a users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9302.
Product
WeChat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Dec 25, 2019Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.CVE-2019-19998 · Other software · Xiuno · reported by MITREHigh 7.5
Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
Product
Xiunobbs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitee.com gitee.com
Dec 20, 2019phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.CVE-2019-19908 · Other software · Ciprianmp · reported by MITREMedium 6.1
phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.
Product
Phpmychat-plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ciprianmp.com cinzinga.github.io
Dec 1, 2019An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows.CVE-2019-19362 · Other software · Teamviewer · reported by MITREMedium 6.5
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges.
Product
Teamviewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nestedif.com nestedif.com
Nov 13, 2019A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34.CVE-2019-16951 · Other software · Enghouse · reported by MITREMedium 5.3
A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses.
Product
Web Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mjlanders.com mjlanders.com
Nov 13, 2019An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34.CVE-2019-16950 · Other software · Enghouse · reported by MITREMedium 6.1
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.
Product
Web Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mjlanders.com mjlanders.com
Nov 13, 2019An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34.CVE-2019-16949 · Other software · Enghouse · reported by MITREMedium 6.5
An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain.
Product
Web Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mjlanders.com mjlanders.com
Nov 13, 2019An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31.CVE-2019-16948 · Other software · Enghouse · reported by MITRECritical 9.8
An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (as opposed to what general web traffic would see on the product's host). The response from open ports is different than from closed ports. The product does not allow one to change the protocol: anything except http(s) will throw an error; however, it is the type of error that allows one to determine if a port is open or not.
Product
Web Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mjlanders.com mjlanders.com
Nov 12, 2019Slack-Chat through 1.5.5 leaks a Slack Access Token in source code.CVE-2019-14367 · Other software · Slack-chat Project · reported by MITREHigh 7.5
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Product
Slack-chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Nov 12, 2019A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), CVE-2018-18819 · Email & office · Mitel · reported by MITREMedium 5.3
A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. A successful exploit could allow execution of arbitrary commands.
Product
Micollab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mitel.com mitel.com
Nov 5, 2019A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessiCVE-2019-1877 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.
Product
Cisco Enterprise Chat and Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Nov 5, 2019Cryptocat has an Unspecified Chat Participant User List DisclosureCVE-2013-4110 · Other software · Cryptocat · reported by Red HatMedium 5.3
Cryptocat has an Unspecified Chat Participant User List Disclosure
Product
Cryptocat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tobtu.com vuldb.com
Nov 4, 2019Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force WeaknessCVE-2013-2257 · Other software · Cryptocat · reported by Red HatHigh 7.5
Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness
Product
Cryptocat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tobtu.com openwall.com
Oct 21, 2019Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.CVE-2019-17220 · Other software · Rocket.chat · reported by MITREMedium 6.1
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
Product
Rocket.chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 11, 2019Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_CVE-2019-17176 · Other software · Genesys · reported by MITREMedium 6.1
Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter).
Product
Eservices Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 9, 2019Sakai through 12.6 allows XSS via a chat user name.CVE-2019-16148 · Other software · Sakailms · reported by MITREMedium 6.1
Sakai through 12.6 allows XSS via a chat user name.
Product
Sakai
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 4, 2019eGain Chat 15.0.3 allows unrestricted file upload.CVE-2019-13976 · Other software · Egain · reported by MITRECritical 9.8
eGain Chat 15.0.3 allows unrestricted file upload.
Product
Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Sep 4, 2019eGain Chat 15.0.3 allows HTML Injection.CVE-2019-13975 · Other software · Egain · reported by MITREMedium 6.1
eGain Chat 15.0.3 allows HTML Injection.
Product
Chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Product
wp-live-chat-support
Fixed in
4.1.0
What to do
Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.CVE-2017-18507 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.05
What to do
Update wp-live-chat-support to 7.1.05 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-14950 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
Product
wp-live-chat-support
Fixed in
8.0.27
What to do
Update wp-live-chat-support to 8.0.27 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 12, 2019The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.CVE-2017-18508 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
7.1.03
What to do
Update wp-live-chat-support to 7.1.03 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 12, 2019The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.CVE-2016-10879 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
Product
wp-live-chat-support
Fixed in
6.2.02
What to do
Update wp-live-chat-support to 6.2.02 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 18, 2019TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection.CVE-2019-1010104 · WordPress plugins & themes · reported by josh@bress.netCritical 9.8
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.
Affected
up to 4.14
What to do
Affects up to 4.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record metalamin.github.io metalamin.github.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.