Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,994 results · page 30 of 60
May 25, 2022SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.CVE-2022-1883 · Other software · camptocamp · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
- Product
- camptocamp/terraboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request.CVE-2021-26631 · Websites & servers · Hometory Co.,Ltd · reported by vuln@krcert.or.krHigh 8
Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order.
- Product
- Mangboard commerce package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
May 16, 2022Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.CVE-2022-30050 · Other software · SIR · reported by MITREMedium 6.1
Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgratis-herring-da5.notion.sitegratis-herring-da5.notion.site
May 11, 2022A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier.CVE-2021-31330 · Other software · Reviewboard · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
- Product
- Review Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattschmidt.netreviewboard.org
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Fast Flow
- Fixed in
- 1.2.12
- What to do
- Update Fast Flow to 1.2.12 or newer.
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Content Egg
- Fixed in
- 5.3.0
- What to do
- Update Content Egg to 5.3.0 or newer.
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.2
- What to do
- Update Advanced Page Visit Counter to 6.1.2 or newer.
Apr 28, 2022Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main pCVE-2021-43932 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9
Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of CVE-2021-29776 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030.
- Product
- QRadar SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 26, 2022Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges.CVE-2021-26628 · Other software · No Vendor Information · reported by vuln@krcert.or.krHigh 8.1
Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.
- Product
- MaxBoard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 25, 2022Pricing Table by Supsystic: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46782 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Pricing Table by Supsystic
- Fixed in
- 1.9.5
- What to do
- Update Pricing Table by Supsystic to 1.9.5 or newer.
Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Coming Soon by Supsystic
- Fixed in
- 1.7.6
- What to do
- Update Coming Soon by Supsystic to 1.7.6 or newer.
Apr 25, 2022Easy Google Maps: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Easy Google Maps
- Fixed in
- 1.9.32
- What to do
- Update Easy Google Maps to 1.9.32 or newer.
Apr 14, 2022SWHKD 1.1.5 consumes the keyboard events of unintended users.CVE-2022-27817 · Other software · Waycrate · reported by MITREMedium 4.4
SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
- Product
- Swhkd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Favicon by RealFaviconGenerator
- Fixed in
- 1.3.23
- What to do
- Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5.CVE-2022-1252 · Other software · gnuboard · reported by security@huntr.devHigh 8.2
Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents
- Product
- gnuboard/gnuboard5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Directus is a real-time API and App dashboard for managing SQL database content.CVE-2022-24814 · Other software · directus · reported by GitHubHigh 8.8
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
- Product
- Insights from Google PageSpeed
- Fixed in
- 4.0.4
- What to do
- Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 1, 2022IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to deCVE-2022-22404 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to denial of service due to excessive rate limiting.
- Product
- App Connect Enterprise Certified Container
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 1, 2022A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) toCVE-2022-21947 · Other software · SUSE · reported by meissner@suse.deHigh 8.3
A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Mar 31, 2022Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) PostCVE-2021-34257 · Other software · Wpanel CMS Project · reported by MITREHigh 8.8
Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
- Product
- Wpanel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlatestpcsolution.wordpress.com
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
- Product
- Popup Builder
- Fixed in
- 4.1.1
- What to do
- Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
- Product
- Pz-LinkCard
- Affected
- up to 2.4.4.4
- What to do
- Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface.CVE-2021-46434 · Other software · Emqx · reported by MITREMedium 5.3
EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
- Product
- Emqx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Geon is a board game based on solving questions about the Pythagorean Theorem.CVE-2022-24781 · Other software · math-geon · reported by GitHubHigh 7.1
Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists.
- Product
- Geon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resultiCVE-2022-27213 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
- Product
- Jenkins Environment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scriCVE-2022-27197 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
- Product
- Jenkins Dashboard View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Cookie Information | Free GDPR Consent Solution
- Fixed in
- 2.0.8
- What to do
- Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022MOLIE: Does not escape the course_id parameter before outputting it back in the admin dashboardCVE-2021-25006 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- MOLIE
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Persian Woocommerce: Does not escape the s parameter before outputting it back in an attribute in the admin dashboardCVE-2021-24940 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
- Product
- Persian Woocommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Persian Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Product
- RegistrationMagic
- Fixed in
- 5.0.2.2
- What to do
- Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 4, 2022Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.CVE-2021-46382 · Network & remote access · Netgear · reported by MITREMedium 6.1
Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.
- Product
- Wac120 AC Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comnetgear.com
Feb 28, 2022Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user.CVE-2022-25014 · Other software · Icehrm · reported by MITREMedium 6.1
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WHMCS Bridge
- Fixed in
- 6.4b
- What to do
- Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP Cloudy, weather: Does not escape the post_id parameter before using it in a SQL statement in the admin dashboardCVE-2021-24864 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
- Product
- WP Cloudy, weather
- Fixed in
- 4.4.9
- What to do
- Update WP Cloudy, weather to 4.4.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Support Board: Does not have any CSRF checks in actions handled by the include/ajaxCVE-2021-24823 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
- Product
- Support Board
- Fixed in
- 3.3.6
- What to do
- Update Support Board to 3.3.6 or newer.
Full record and what to do →NVD recordnoob3xploiter.medium.comwpscan.com
Feb 24, 2022A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.CVE-2021-29217 · Other software · HPE · reported by security-alert@hpe.comMedium 6.1
A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
- Product
- Oneview Global Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 24, 2022A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.CVE-2021-29216 · Other software · HPE · reported by security-alert@hpe.comMedium 6.1
A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
- Product
- Oneview Global Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
- Product
- Database Backup for
- Fixed in
- 2.5.1
- What to do
- Update Database Backup for to 2.5.1 or newer.
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 15, 2022CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.CVE-2021-41552 · Other software · Commscope · reported by MITREHigh 8.8
CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.
- Product
- Arris Surfboard Sbg6950ac2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarris.my.salesforce.comcommscope.com
Feb 11, 2022Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.CVE-2022-24001 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.8
Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.24
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 1, 2022Custom Dashboard & Login Page: Does not sanitise some of its settingsCVE-2021-24944 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Custom Dashboard & Login Page
- Fixed in
- 7.0
- What to do
- Update Custom Dashboard & Login Page to 7.0 or newer.
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
- Product
- WP User Frontend
- Fixed in
- 3.5.26
- What to do
- Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jan 24, 2022myCred: Does not sanitise and escape the search query before outputting it back in the history dashboard pageCVE-2021-25015 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
- Product
- myCred
- Fixed in
- 2.4
- What to do
- Update myCred to 2.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.