Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,672 results · page 31 of 54
May 17, 2024A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface whenCVE-2024-34241 · Other software · rocketsoft · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.
- Product
- rocket_lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024WP Express Checkout (Accept PayPal Payments): Improper Validation of Specified Quantity in InputCVE-2024-30527 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.
- Product
- WP Express Checkout (Accept PayPal Payments)
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update WP Express Checkout (Accept PayPal Payments) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload CVE-2024-30801 · Other software · beijing_xinwang_medical_information_technology · reported by MITREMedium 5.5
SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload to Login.asp component.
- Product
- cloud_based_customer_service_management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordminipacs.comgithub.com
May 14, 2024SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php cCVE-2024-26517 · Other software · Rems · reported by MITRECritical 9.1
SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php component.
- Product
- School Task Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 14, 2024Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.CVE-2024-22910 · Other software · Crushftp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 7, 2024In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.CVE-2024-4456 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.1
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
May 7, 2024An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id CVE-2024-32370 · Other software · hsc · reported by MITRECritical 9.8
An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component.
- Product
- mailinspector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
May 6, 2024Memory corruption when the payload received from firmware is not as per the expected protocol size.CVE-2024-21475 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when the payload received from firmware is not as per the expected protocol size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.qualcomm.comdocs.qualcomm.com
May 6, 2024Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.CVE-2023-43528 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.qualcomm.comdocs.qualcomm.com
May 3, 2024netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page.CVE-2024-33793 · Other software · netis-systems · reported by MITREMedium 5.3
netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page.
- Product
- mex605
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page.CVE-2024-33792 · Other software · netis-systems · reported by MITRECritical 9.8
netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page.
- Product
- mex605
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injeCVE-2024-33791 · Other software · netis-systems · reported by MITREMedium 4.6
A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the getTimeZone function.
- Product
- mex605
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload.CVE-2024-4216 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 7.4
pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 2, 20242Checkout Payment Gateway for WooCommerce: Unauthorized modification of dataCVE-2024-0629 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 2Checkout Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sniff_ins function in all versions up to, and including, 6.2. This makes it possible for unauthenticated attackers to make changes to orders and mark them as paid.
- Product
- 2Checkout Payment Gateway for WooCommerce
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update 2Checkout Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
May 1, 2024Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload CVE-2024-33423 · Other software · cmsimple · reported by MITREHigh 7.4
Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-33424 · Other software · cmsimple · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.CVE-2024-26504 · Other software · wifire · reported by MITREHigh 8.8
An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.
- Product
- hotspot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgportswigger.net
Apr 30, 2024Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.CVE-2024-29320 · Other software · ellite · reported by MITREHigh 8.1
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
- Product
- wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontControCVE-2024-33267 · Other software · htc · reported by MITRECritical 9.8
SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontController::initContent() function.
- Product
- hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgheropay.eu
Apr 29, 2024Payment Gateway Based Fees and Discounts for WooCommerce: Missing AuthorizationCVE-2024-33585 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.
- Product
- Payment Gateway Based Fees and Discounts for WooCommerce
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Payment Gateway Based Fees and Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Leaky Paywall: Missing AuthorizationCVE-2024-33594 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Leaky Paywall.This issue affects Leaky Paywall: from n/a through 4.20.8.
- Product
- Leaky Paywall
- Affected
- up to 4.20.8
- What to do
- Affects up to 4.20.8. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Easy Accept Payments: Missing AuthorizationCVE-2024-33591 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through 4.9.10.
- Product
- Easy Accept Payments
- Affected
- up to 4.9.10
- What to do
- Affects up to 4.9.10. Update Easy Accept Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload toCVE-2024-31828 · Other software · lavalite · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjinmu1108.github.iojinmu1108.github.io
Apr 26, 2024Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload tCVE-2024-32406 · Other software · Inducer · reported by MITREHigh 7.5
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function.
- Product
- Relate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 26, 2024Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via a crafted payload tCVE-2024-32404 · Other software · inducer · reported by MITREMedium 6
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via a crafted payload to the Markup Sandbox feature.
- Product
- relate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 25, 2024Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php componentCVE-2024-29660 · Other software · dedecms · reported by MITREMedium 5.3
Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2024Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload to the Answer field oCVE-2024-32405 · Other software · Inducer · reported by MITRELow 2.6
Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload to the Answer field of InlineMultiQuestion parameter on Exam function.
- Product
- Relate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstormsecurity.com
Apr 22, 2024An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.CVE-2024-32407 · Other software · Inducer · reported by MITREHigh 8.8
An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.
- Product
- Relate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbook.hacktricks.xyzcxsecurity.com
Apr 22, 2024A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the stCVE-2022-34562 · Websites & servers · Phpfox · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the status box.
- Product
- Phpfox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmohammedshine.github.iov4.phpfox.com
Apr 22, 2024A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the viCVE-2022-34561 · Websites & servers · phpfox · reported by MITREMedium 4.3
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the video description parameter.
- Product
- phpfox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmohammedshine.github.iov4.phpfox.com
Apr 22, 2024A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the HiCVE-2022-34560 · Websites & servers · Phpfox · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the History parameter.
- Product
- Phpfox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgmohammedshine.github.io
Apr 22, 2024A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.CVE-2024-29661 · Other software · dedecms · reported by MITRECritical 9.8
A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.CVE-2024-32391 · Other software · maccms · reported by MITREHigh 7.3
Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.
- Product
- maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-32345 · Other software · cmsimple · reported by MITREHigh 7.2
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2024-32344 · Other software · cmsimple · reported by MITREMedium 6.8
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit parameter under the Language section.
- Product
- cmsimple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2024-32343 · Other software · boidcms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
- Product
- boidcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2024-32342 · Other software · boidcms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Permalink parameter.
- Product
- boidcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2024-30953 · Other software · htmly · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link Name parameter of Menu Editor module.
- Product
- htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2024-30950 · Other software · fudforum · reported by MITRELow 3.5
A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SQL statements field under /adm/admsql.php.
- Product
- fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectedCVE-2024-30952 · Other software · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Loopus WP Cost Estimation & Payment Forms Builder allows Reflected XSS.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.
- Product
- WP Cost Estimation & Payment Forms Builder
- Affected
- up to 10.1.75
- What to do
- Affects up to 10.1.75. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2024Payment Forms for Paystack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32130 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.
- Product
- Payment Forms for Paystack
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2024-32509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76.
- Product
- WP Cost Estimation & Payment Forms Builder
- Affected
- up to 10.1.76
- What to do
- Affects up to 10.1.76. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 16, 2024An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src compCVE-2024-31784 · Other software · appmakes.io · reported by MITREMedium 6.1
An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component.
- Product
- typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpointCVE-2024-3029 · Other software · mintplex-labs · reported by security@huntr.devHigh 8
In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payloCVE-2020-22540 · Other software · Codologic · reported by MITREMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 15, 2024A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2024-31651 · Other software · cosmetics_and_beauty_product_online_store_project · reported by MITREMedium 6.1
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
- Product
- cosmetics_and_beauty_product_online_store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2024-31652 · Other software · Oretnom23 · reported by MITREMedium 6.1
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
- Product
- Cosmetics And Beauty Product Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2024-31650 · Other software · cosmetics_and_beauty_product_online_store_project · reported by MITRECritical 9.6
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
- Product
- cosmetics_and_beauty_product_online_store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2024-31649 · Other software · cosmetics_and_beauty_product_online_store_project · reported by MITREMedium 5.4
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
- Product
- cosmetics_and_beauty_product_online_store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.