Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
36added in the last 30 days
584new WordPress flaws this week
391,288entries in the database

140 results · page 3 of 3

  • Jun 21, 2022A vulnerability was found in Hindu Matrimonial Script.CVE-2017-20067 · Other software · unspecified · reported by VulDBHigh 7.3

    A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

    Product
    Hindu Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 5, 2022Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.CVE-2022-26628 · Other software · Matrimony Project · reported by MITRECritical 9.8

    Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.

    Product
    Matrimony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2021All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.CVE-2021-23425 · Other software · Trim-off-newlines Project · reported by report@snyk.ioMedium 5.3

    All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

    Product
    Trim-off-newlines
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 30, 2021uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll).CVE-2020-36406 · Other software · Uwebsockets Project · reported by MITREHigh 8.8

    uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's position is that this is "a minor issue or not even an issue at all" because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate

    Product
    Uwebsockets
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 28, 2021The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() methCVE-2021-33623 · Other software · Trim-newlines Project · reported by MITREHigh 7.5

    The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

    Product
    Trim-newlines
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 15, 2021Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.CVE-2020-28500 · Other software · Lodash · reported by report@snyk.ioMedium 5.3

    Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

    Product
    Lodash
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 23, 2020Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code exCVE-2020-27397 · Other software · Projectworlds · reported by MITREHigh 8.8

    Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the Hosting web server via uploading a maliciously crafted PHP file.

    Product
    Online Matrimonial Project
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 27, 2020All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().CVE-2020-7753 · Other software · Trim Project · reported by report@snyk.ioHigh 7.5

    All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

    Product
    Trim
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 14, 2020In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check.CVE-2020-0412 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3

    In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. This could lead to local information disclosure of foreground processes with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.0 Android-8.1 Android-9Android ID: A-160390416

    Product
    Android
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 14, 2018In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset.CVE-2018-9543 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 5.5

    In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112868088.

    Product
    Android
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 14, 2018Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via CVE-2018-17465 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8

    Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

    Product
    Chrome
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 20, 2018trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.CVE-2018-14447 · Other software · Libconfuse Project · reported by MITREHigh 8.8

    trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.

    Product
    Libconfuse
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 7, 2018Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.CVE-2018-13421 · Other software · Fast-cpp-csv-parser Project · reported by MITRECritical 9.8

    Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.

    Product
    Fast-cpp-csv-parser
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 25, 2018The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) vCVE-2018-11468 · Other software · Discount Project · reported by MITREMedium 5.5

    The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.

    Product
    Discount
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 9, 2018Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directCVE-2018-0543 · Other software · WoodyBells · reported by vultures@jpcert.or.jpHigh 7.8

    Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

    Product
    Jtrim
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.CVE-2018-6864 · Other software · Multireligion Responsive Matrimonial Project · reported by MITREMedium 5.4

    Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.

    Product
    Multireligion Responsive Matrimonial
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.CVE-2017-17988 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8

    PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.CVE-2017-17987 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 7.2

    PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.CVE-2017-17986 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8

    PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.CVE-2017-17985 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8

    PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.CVE-2017-17984 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8

    PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.CVE-2017-17983 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 8.8

    PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.CVE-2017-17982 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 6.8

    PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.CVE-2017-17981 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 5.4

    PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 13, 2017Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.CVE-2017-17639 · Other software · Muslim Matrimonial Script Project · reported by MITRECritical 9.8

    Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.

    Product
    Muslim Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 13, 2017Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.CVE-2017-17631 · Other software · Multireligion Responsive Matrimonial Project · reported by MITRECritical 9.8

    Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.

    Product
    Multireligion Responsive Matrimonial
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 26, 2017In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficientCVE-2017-11658 · WordPress plugins & themes · reported by MITREHigh 7.5

    In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.

    Product
    WP Rocket
    What to do
    Update WP Rocket to the newest version.
  • Jul 23, 2016Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to causCVE-2016-5129 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8

    Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.

    Product
    Chrome
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions tCVE-2015-5489 · Other software · Smart Trim Project · reported by MITRELow 3.5

    Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.

    Product
    Smart Trim
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 1, 2014Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitCVE-2013-7388 · Computers, phones & browsers · Google · reported by MITREHigh 9.3

    Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP). NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1).

    Product
    Sketchup
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 1, 2014Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MACCVE-2013-3664 · Computers, phones & browsers · Google · reported by MITREHigh 9.3

    Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

    Product
    Sketchup
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 13, 2014Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, allows remote attackers to execute arbitrCVE-2013-3663 · Computers, phones & browsers · Google · reported by MITREHigh 9.3

    Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed BMP.

    Product
    Sketchup
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 17, 2013Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file.CVE-2013-6038 · Other software · Trimble · reported by cret@cert.orgMedium 6.8

    Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file.

    Product
    Sketchup Viewer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 6, 2013Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS Series Receivers NetR3, NetR5, NetR8, and NetR9 beforCVE-2012-5053 · Other software · Trimble · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS Series Receivers NetR3, NetR5, NetR8, and NetR9 before 4.70, and NetRS before 1.3-2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Product
    Infrastructure Gnss Series Receiver Netr3
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 28, 2010SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-2512 · Other software · 2daybiz · reported by MITREHigh 7.5

    SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Product
    Matrimonial Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 7, 2010The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtainCVE-2010-2190 · Websites & servers · PHP · reported by MITREMedium 5

    The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

    Product
    PHP
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 14, 2007Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitraCVE-2007-1453 · Websites & servers · PHP · reported by MITREHigh 7.5

    Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filter_var with certain modes such as FILTER_VALIDATE_INT, which causes filter to write a null byte in whitespace that precedes the buffer.

    Product
    PHP
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 10, 2005Multiple buffer overflows in the (1) write_heading function in subs.cpp or (2) trim_title function in parse.cpp for abctab2ps 1.6.3 allow remote attackers to exCVE-2004-1260 · Other software · Abctab2ps · reported by MITREHigh 10

    Multiple buffer overflows in the (1) write_heading function in subs.cpp or (2) trim_title function in parse.cpp for abctab2ps 1.6.3 allow remote attackers to execute arbitrary code via crafted ABC files.

    Product
    Abctab2ps
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2004Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or HTML via the strImageCVE-2004-1882 · Other software · Cactusoft · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or HTML via the strImageTag parameter.

    Product
    Cactushop
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 3, 2004The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remCVE-2004-0815 · Other software · Samba · reported by MITREHigh 7.5

    The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.

    Product
    Samba
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.