Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,620 results · page 29 of 73
Apr 13, 2023Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/login.php.CVE-2023-29622 · Other software · Purchase Order Management Project · reported by MITRECritical 9.8
Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/login.php.
- Product
- Purchase Order Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comportswigger.net
Apr 13, 2023AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.CVE-2023-27779 · Other software · Amsystem · reported by MITRECritical 9.8
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
- Product
- AM Presencia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamsystem.esdocs.google.com
Apr 11, 2023Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via CVE-2023-1980 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via the application user interface and open entries.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Apr 6, 2023Limit Login Attempts: Stored Cross-Site ScriptingCVE-2023-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.
- Product
- Limit Login Attempts
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgpluginvulnerabilities.com
Apr 5, 2023Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.CVE-2022-31888 · Other software · Enhancesoft · reported by MITREHigh 8.8
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmarx.comgithub.com
Apr 5, 2023Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login.CVE-2023-26856 · Other software · Dynamic Transaction Queuing System Project · reported by MITREHigh 7.2
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login.
- Product
- Dynamic Transaction Queuing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.CVE-2023-27089 · Other software · Ehuacui-bbs Project · reported by MITREHigh 8.2
Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter.
- Product
- Ehuacui-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web CVE-2022-47870 · Other software · Red-gate · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web Script or HTML via the returnUrl parameter.
- Product
- SQL Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 28, 2023A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web CVE-2023-27008 · Other software · Atutor · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
- Product
- Atutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplantplants213607121.wordpress.complantplants213607121.wordpress.com
Mar 23, 2023TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.CVE-2022-28492 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.CVE-2023-24709 · Other software · Paradox · reported by MITREHigh 7.5
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.
- Product
- Ipr512 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.CVE-2022-38063 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
- Affected
- up to 5.0.0.0
- What to do
- Affects up to 5.0.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 vCVE-2023-25968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 versions.
- Fixed in
- 1.1.9
- What to do
- Update the plugin to 1.1.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 14, 2023BP Monitoring Management System v1.0 was discovered to contain a SQL injection vulnerability via the emailid parameter in the login page.CVE-2023-27074 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
BP Monitoring Management System v1.0 was discovered to contain a SQL injection vulnerability via the emailid parameter in the login page.
- Product
- BP Monitoring Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Mar 13, 2023Akuvox E11 cloud login is performed through an unencrypted HTTP connection.CVE-2023-0346 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitraCVE-2022-48111 · Other software · Siri-informatica · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
- Product
- Wi400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevisions.github.iolabs.yarix.com
Mar 9, 2023A cross-site scripting (XSS) vulnerability in /php-opos/login.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary web scripts or HTML CVE-2023-27208 · Other software · Online Pizza Ordering System Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /php-opos/login.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the redirect parameter.
- Product
- Online Pizza Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 7, 2023An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allowCVE-2022-41333 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests.
- Product
- FortiRecorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfortiguard.com
Mar 3, 2023Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application manageCVE-2023-23313 · Network & remote access · Draytek · reported by MITREMedium 6.1
Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.
- Product
- Vigor2860 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddraytek.comhorizonconsulting.com
Feb 27, 2023Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the Admin Login.CVE-2023-23155 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the Admin Login.
- Product
- ART Gallery Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comphpgurukul.com
Feb 23, 2023A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments coCVE-2023-20012 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability is due to the improper implementation of the password validation function. An attacker could exploit this vulnerability by logging in to the console port on an affected device. A successful exploit could allow the attacker to bypass authentication and execute a limited set of commands local to the FEX, which could cause a device reboot and denial of service (DoS) condition.
- Product
- Cisco Unified Computing System (Managed)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Feb 22, 2023Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileCVE-2022-45599 · Other software · Aztech · reported by MITRECritical 9.8
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts hashed password.
- Product
- Wmb250ac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.CVE-2022-45677 · Other software · Tuition Management System Project · reported by MITRECritical 9.8
SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.
- Product
- Tuition Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4622 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Login Logout Menu
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Login Logout Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2023SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitraCVE-2022-40032 · Other software · Simple Task Managing System Project · reported by MITRECritical 9.8
SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.
- Product
- Simple Task Managing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 13, 2023Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.CVE-2022-48323 · Other software · Sunlogin · reported by MITRECritical 9.8
Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.
- Product
- Sunflower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasec.ahnlab.comgithub.com
Feb 10, 2023Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login staCVE-2022-46650 · Other software · Sierrawireless · reported by security@sierrawireless.comMedium 4.9
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page.
- Product
- Aleos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comcisa.gov
Feb 10, 2023D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.CVE-2023-24351 · Other software · Dlink · reported by MITRECritical 9.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.
- Product
- Dir-605l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Clean Login
- Fixed in
- 1.13.7
- What to do
- Update Clean Login to 1.13.7 or newer.
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.CVE-2023-24192 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 1, 2023In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS.CVE-2023-23127 · Other software · Connectwise · reported by MITREMedium 5.3
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
- Product
- Connectwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.CVE-2023-24241 · Other software · Forget Heart Message BOX Project · reported by MITRECritical 9.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
- Product
- Forget Heart Message BOX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Efence login function has insufficient validation for user input.CVE-2023-22900 · Other software · Thinking Software Technology Co., Ltd. · reported by twcert@cert.org.twCritical 9.8
Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
- Product
- Efence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.CVE-2023-24020 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 7.5
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.CVE-2023-24456 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
- Product
- Jenkins Keycloak Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.CVE-2023-24445 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.CVE-2023-24444 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.CVE-2023-24427 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
- Product
- Jenkins Bitbucket OAuth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.CVE-2023-24426 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
- Product
- Jenkins Azure AD Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.CVE-2023-24424 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Login Logout Menu
- Fixed in
- 1.4.0
- What to do
- Update Login Logout Menu to 1.4.0 or newer.
Jan 23, 2023Login as User or Customer: Lacks authorization checks to ensure that users are allowed to log inCVE-2022-4305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
- Product
- Login as User or Customer
- Fixed in
- 3.3
- What to do
- Update Login as User or Customer to 3.3 or newer.
Jan 23, 2023WP Limit Login Attempts: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4303 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
- Product
- WP Limit Login Attempts
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update WP Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2023A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request heCVE-2023-24044 · Websites & servers · Plesk · reported by MITREMedium 6.1
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commedium.com
Jan 20, 2023The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forCVE-2023-23492 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.
- Fixed in
- 1.4.2
- What to do
- Update the plugin to 1.4.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 17, 2023The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing theCVE-2023-23749 · Other software · miniorange · reported by security@joomla.orgHigh 7.5
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.
- Product
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.44
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Jan 12, 2023Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.CVE-2022-46502 · Other software · Online Student Enrollment System Project · reported by MITRECritical 9.8
Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
- Product
- Online Student Enrollment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target pCVE-2023-22958 · Other software · Syracom · reported by MITREMedium 6.1
The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.
- Product
- Secure Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code.CVE-2022-43528 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.8
Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successful exploitation allows an attacker to login using only a username and password and successfully bypass MFA requirements in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.
- Product
- Aruba EdgeConnect Enterprise Orchestration Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.