Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
354 results · page 3 of 8
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2025There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55.CVE-2025-49081 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse over the network. The attack complexity is low, there are no attack requirements, privileges required are high, and there is no user interaction required. There is no impact on confidentiality or integrity; the impact on availability is high.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or CVE-2025-42983 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.5
SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any data.
- Product
- SAP Business Warehouse and SAP Plug-In Basis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0.CVE-2025-5163 · Other software · yangshare 技术杨工 · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- warehouseManager 仓库管理系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Fish House: Deserialization of Untrusted DataCVE-2025-31631 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
- Product
- Fish House
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Fish House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.CVE-2019-16536 · Other software · Clickhouse · reported by browser-security@yandex-team.ruHigh 8.2
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
- Product
- DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability.CVE-2025-1520 · Other software · PostHog · reported by zdi-disclosures@trendmicro.comHigh 8
PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the SQL parser. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the database account. Was ZDI-CAN-25350.
- Product
- PostHog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Apr 16, 2025The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules.CVE-2025-32791 · Other software · backstage · reported by GitHubMedium 4.3
The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact. This issue has been patched in version 0.6.0 of the permissions backend. A workaround includes having administrators of the permission policies ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permCVE-2024-55070 · Other software · Mealie · reported by MITRELow 3.1
A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint.CVE-2024-8999 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost.CVE-2025-1385 · Other software · ClickHouse · reported by cb7ba516-3b07-4c98-b0c2-715220f1a8f6High 7.5
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
- Product
- ClickHouse OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3.CVE-2025-2217 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3. This affects the function ProcessRequest of the file /getAdyData.ashx. The manipulation of the argument showid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3.CVE-2025-2216 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check.CVE-2025-25244 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.7
SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.
- Product
- SAP Business Warehouse (Process Chains)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1.CVE-2025-2115 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2025Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker withCVE-2022-28339 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.3
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
- Product
- Trend Micro HouseCall for Home Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comzerodayinitiative.com
Feb 6, 2025A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical.CVE-2025-1078 · Other software · AppHouseKitchen · reported by VulDBMedium 4.8
A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper of the component XPC Service. The manipulation leads to improper authorization. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.30 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional.
- Product
- AlDente Charge Limiter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic.CVE-2025-0398 · Other software · longpi1 · reported by VulDBMedium 5.1
A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /resources/..;/inport/updateInport of the component Backend. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as problematic was found in SingMR HouseRent 1.0.CVE-2024-13213 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in SingMR HouseRent 1.0. This vulnerability affects unknown code of the file /toAdminUpdateHousePage?hID=30. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as critical has been found in SingMR HouseRent 1.0.CVE-2024-13212 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability was found in SingMR HouseRent 1.0.CVE-2024-13211 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/java/com/house/wym/controller/AdminController.java. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024A vulnerability was found in CodeAstro House Rental Management System 1.0.CVE-2024-12944 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signin.php. The manipulation of the argument u/p leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- House Rental Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 26, 2024A vulnerability was found in CodeAstro House Rental Management System 1.0.CVE-2024-12943 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ownersignup.php. The manipulation of the argument f/e/p/m/o/n/c/s/ci/a leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "m" to be affected. But it must be assumed that many other parameters are affected as well.
- Product
- House Rental Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 2, 2024Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.CVE-2024-52732 · Other software · warehouse_management_system_zeqp · reported by MITRECritical 9.1
Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.
- Product
- warehouse_management_system_zeqp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 29, 2024The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules.CVE-2024-53983 · Other software · backstage · reported by GitHubMedium 5.4
The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username paraCVE-2024-48579 · Websites & servers · php · reported by MITRECritical 9.8
SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login request.
- Product
- best_house_rental_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabCVE-2024-47483 · Other software · Dell · reported by security_alert@emc.comLow 2.9
Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Data Lakehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability.CVE-2024-47481 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- Dell Data Lakehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.CVE-2024-46377 · Other software · sourcecodester · reported by MITRECritical 9.8
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.
- Product
- best_house_rental_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php.CVE-2024-46376 · Other software · best_house_rental_management_system · reported by MITRECritical 9.8
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php.
- Product
- best_house_rental_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php.CVE-2024-46375 · Other software · best_house_rental_management_system · reported by MITRECritical 9.8
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php.
- Product
- best_house_rental_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the file rental/admin_class.php.CVE-2024-46374 · Other software · best_house_rental_management_system · reported by MITRECritical 9.8
Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the file rental/admin_class.php.
- Product
- best_house_rental_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45855 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45854 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45853 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otheCVE-2024-44113 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
- Product
- SAP Business Warehouse (BEx Analyzer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.CVE-2024-41436 · Other software · clickhouse · reported by MITREHigh 7.5
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
- Product
- clickhouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42586 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42585 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42584 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42583 · Other software · warehouse_inventory_system · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42582 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42581 · Other software · oswapp · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42580 · Other software · oswapp · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42579 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42578 · Other software · oswapp · reported by MITREHigh 8
A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42577 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42576 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024House Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3973 · WordPress plugins & themes · reported by WPScanMedium 4.8
The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- House Manager
- Affected
- up to 1.0.8.4
- What to do
- Affects up to 1.0.8.4. Update House Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 4, 2024A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0.CVE-2024-7460 · Other software · OSWAPP · reported by VulDBMedium 6.9
A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change_password.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273553 was assigned to this vulnerability.
- Product
- Warehouse Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.