Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
340 results · page 3 of 7
Mar 21, 2019PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory.CVE-2019-7431 · Other software · Image Sharing Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory.
- Product
- Image Sharing Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar.CVE-2019-7430 · Other software · Image Sharing Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar.
- Product
- Image Sharing Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploadCVE-2019-7429 · Other software · Property Rental Software Project · reported by MITREMedium 6.5
PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2016/08 directory.
- Product
- Property Rental Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.CVE-2018-20648 · Other software · CAR Rental Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.CVE-2018-20647 · Other software · CAR Rental Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.CVE-2018-20646 · Other software · Basic B2b Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.CVE-2018-20645 · Other software · Basic B2b Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.CVE-2018-20644 · Other software · Basic B2b Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directCVE-2018-20643 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript coCVE-2018-20642 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript code in the KeySkills field.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.CVE-2018-20641 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.CVE-2018-20640 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar.CVE-2018-20639 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assetsCVE-2018-20638 · Other software · Chartered Accountant \ · reported by MITREMedium 6.5
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavCVE-2018-20637 · Other software · Chartered Accountant \ · reported by MITREMedium 6.5
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavaScript code in the First Name and Last Name field.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.CVE-2018-20636 · Other software · Chartered Accountant \ · reported by MITREMedium 5.4
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.CVE-2018-20635 · Other software · Advance B2b Script Project · reported by MITREMedium 4.3
PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
- Product
- Advance B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name fiCVE-2018-20634 · Other software · Advance B2b Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name field.
- Product
- Advance B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.CVE-2018-20633 · Other software · Advance B2b Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
- Product
- Advance B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.CVE-2018-20632 · Other software · Advance B2b Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.
- Product
- Advance B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file.CVE-2018-20631 · Other software · Website Seller Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uplCVE-2018-20630 · Other software · Advance Crowdfunding Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
- Product
- Advance Crowdfunding Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-coCVE-2018-20629 · Other software · Charity Donation Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
- Product
- Charity Donation Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-contCVE-2018-20628 · Other software · Charity Foundation Script Project · reported by MITREHigh 7.5
PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
- Product
- Charity Foundation Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box.CVE-2018-20627 · Other software · Consumer Reviews Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box.
- Product
- Consumer Reviews Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploadsCVE-2018-20626 · Other software · Consumer Reviews Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
- Product
- Consumer Reviews Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file.CVE-2019-9607 · Other software · Medical Store Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file.
- Product
- Medical Store Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Mar 6, 2019PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature.CVE-2019-9606 · Other software · Personal Video Collection Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature.
- Product
- Personal Video Collection Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 23, 2019PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.CVE-2019-9066 · Websites & servers · PHP Appointment Booking Script Project · reported by MITREMedium 5.4
PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.
- Product
- PHP Appointment Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 23, 2019PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount.CVE-2019-9065 · Websites & servers · Custom T-shirt Ecommerce Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount.
- Product
- Custom T-shirt Ecommerce Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 23, 2019PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.CVE-2019-9064 · Other software · CAB Booking Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.
- Product
- CAB Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 23, 2019PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount.CVE-2019-9063 · Other software · Auction Website Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount.
- Product
- Auction Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 23, 2019PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php.CVE-2019-9062 · Websites & servers · Phpscriptsmall · reported by MITREHigh 8
PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php.
- Product
- Online Food Ordering Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Feb 16, 2019PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar.CVE-2019-8361 · Other software · Responsive Video News Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
- Product
- Responsive Video News Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Jan 12, 2019PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php.CVE-2019-6248 · Other software · Citysearch / Hotfrog / Gelbeseiten Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php.
- Product
- Citysearch / Hotfrog / Gelbeseiten Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Jan 11, 2019The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigatingCVE-2019-6126 · Other software · Advance Peer TO Peer MLM Script Project · reported by MITREHigh 7.5
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff.
- Product
- Advance Peer TO Peer MLM Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.CVE-2018-20530 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Dec 20, 2018WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via BlinCVE-2018-1000867 · Other software · Webidsupport · reported by MITREHigh 8.8
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
- Product
- Webid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.webidsupport.comgithub.com
Dec 13, 2018PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.CVE-2018-20138 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
- Product
- Entrepreneur B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Oct 4, 2018PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img directory.CVE-2018-16457 · Other software · Open Source Real-estate Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img directory.
- Product
- Open Source Real-estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Oct 4, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword.CVE-2018-16456 · Websites & servers · Phpscriptsmall · reported by MITREMedium 6.1
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Oct 4, 2018PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.CVE-2018-16455 · Other software · Marketplace Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.
- Product
- Marketplace Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Oct 4, 2018PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.CVE-2018-16453 · Other software · Domain Lookup Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.
- Product
- Domain Lookup Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Oct 4, 2018PHP Scripts Mall Olx Clone 3.4.2 has XSS.CVE-2018-16326 · Websites & servers · Phpscriptsmall · reported by MITREMedium 6.1
PHP Scripts Mall Olx Clone 3.4.2 has XSS.
- Product
- OLX Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Sep 7, 2018PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted comma.CVE-2018-16454 · Other software · Currency Converter Script Project · reported by MITREHigh 7.5
PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted comma.
- Product
- Currency Converter Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglequeens.comgooglequeens.com
Aug 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, CompCVE-2018-15897 · Other software · Website Seller Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.CVE-2018-15896 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or AdCVE-2018-15191 · Other software · Hotel Booking Script Project · reported by MITREMedium 6.5
PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or Address field.
- Product
- Hotel Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.CVE-2018-15190 · Other software · Hotel Booking Script Project · reported by MITREMedium 5.4
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.
- Product
- Hotel Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.CVE-2018-15189 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 5.4
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.