Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
176 results · page 3 of 4
Oct 28, 2022Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.CVE-2021-37782 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.
- Product
- Employee Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Oct 28, 2022Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.CVE-2021-37781 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.
- Product
- Employee Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Oct 28, 2022Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.CVE-2021-35388 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Oct 28, 2022Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.CVE-2021-35387 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Sep 30, 2022Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.CVE-2022-40943 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Sep 30, 2022Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..CVE-2022-35156 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 30, 2022Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.CVE-2022-35155 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 30, 2022Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.CVE-2022-40944 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaicaizi.topgithub.com
Sep 26, 2022Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the backgroCVE-2022-40925 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the background management system.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the backgCVE-2022-40924 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the background management system.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 22, 2022In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the CVE-2022-40932 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the background management system.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2022Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspaCVE-2022-36198 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspassms/admin/changeimage.php, buspassms/admin/search-pass.php, buspassms/admin/edit-category-detail.php, and buspassms/admin/edit-pass-detail.php
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Jul 5, 2022A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scrCVE-2022-33075 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 16, 2022Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.CVE-2022-31384 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.
- Product
- Directory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.CVE-2022-31383 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.
- Product
- Directory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.CVE-2022-31382 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.
- Product
- Directory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.CVE-2022-31914 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF).CVE-2022-30930 · Websites & servers · Phpgurukul · reported by MITREMedium 4.3
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF).
- Product
- Tourism Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comacunetix.com
May 23, 2022Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute CVE-2022-29005 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.
- Product
- Online Birth Certificate System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
May 23, 2022Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.CVE-2022-29004 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.
- Product
- E-diary Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
May 20, 2022A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request.CVE-2022-28992 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request.
- Product
- Online Banquet Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackersCVE-2022-29009 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.
- Product
- Cyber Cafe Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive informaCVE-2022-29008 · Websites & servers · Phpgurukul · reported by MITREMedium 6.5
An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers toCVE-2022-29007 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypasCVE-2022-29006 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.
- Product
- Directory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 6, 2022Joomla Guru extension 5.2.5 is affected by: Insecure Permissions.CVE-2022-23802 · Other software · ijoomla.com · reported by security@joomla.orgHigh 7.5
Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components, possibility to view other users' information.
- Product
- Guru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordguru.ijoomla.comguru.ijoomla.com
May 5, 2022All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code.CVE-2021-38439 · Other software · GurumNetworks · reported by ics-cert@hq.dhs.govHigh 8.6
All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code.
- Product
- GurumDDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.CVE-2021-38423 · Other software · GurumNetworks · reported by ics-cert@hq.dhs.govMedium 6.6
All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.
- Product
- GurumDDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public_html/animals via the class_id parameter.CVE-2022-27992 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public_html/animals via the class_id parameter.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 8, 2022Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy.CVE-2022-27351 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Feb 18, 2022Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.CVE-2021-46110 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.
- Product
- Online Shopping Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgiant-falcon-36d.notion.sitegiant-falcon-36d.notion.site
Feb 15, 2022Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.CVE-2022-24226 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if CVE-2020-36062 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Feb 10, 2022Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parametCVE-2022-24646 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.CVE-2022-24263 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 25, 2022Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.CVE-2022-0338 · Other software · delgan · reported by security@huntr.devMedium 4.3
Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.
- Product
- delgan/loguru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.CVE-2021-44317 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the applicatCVE-2021-44315 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php.CVE-2021-43137 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
- Product
- Hostel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 27, 2021A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endpoCVE-2021-37805 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endpoint.
- Product
- Vehicle Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 13, 2021SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.CVE-2021-42224 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
- Product
- Ifsc Code Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 13, 2021Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.CVE-2021-42223 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
- Product
- Online DJ Booking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Aug 19, 2021A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrarCVE-2021-27822 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Category field.
- Product
- Vehicle Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 1, 2021A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HCVE-2021-28424 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in adminprofile.php.
- Product
- Teachers Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnhattruong.blogpacketstormsecurity.com
Jul 1, 2021Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via CVE-2021-28423 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php.
- Product
- Teachers Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnhattruong.blogpacketstormsecurity.com
May 26, 2021COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.CVE-2021-33470 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
- Product
- Covid19 Testing Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 26, 2021COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.CVE-2021-33469 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
- Product
- Covid19 Testing Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpgurukul.comexploit-db.com
Apr 25, 2021Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a CVE-2021-20693 · Other software · Gurunavi, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
- Product
- Gurunavi App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php.CVE-2021-26822 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. This vulnerability can be exploited by a remote unauthenticated attacker to leak sensitive information and perform code execution attacks.
- Product
- Teachers Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Feb 8, 2021Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters.CVE-2020-26052 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters.
- Product
- Online Marriage Registration System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.