Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,672 results · page 33 of 54
Mar 5, 2024A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecteCVE-2023-49973 · Other software · Oretnom23 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customer_support/index.php?page=customer_list.
- Product
- Customer Support System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 5, 2024A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecteCVE-2023-49971 · Other software · sourcecodester · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list.
- Product
- customer_support_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 5, 2024An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the messagCVE-2024-24278 · Other software · teamwire · reported by MITREHigh 7.5
An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.
- Product
- teamwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.hisolutions.comresearch.hisolutions.com
Mar 4, 2024Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.CVE-2023-33095 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 1, 2024A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2024-25438 · Other software · pkp · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
- Product
- open_journal_systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 1, 2024A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2024-25436 · Other software · SFU · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
- Product
- Open Journal Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 1, 2024A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PubCVE-2024-25434 · Other software · Pkp.sfu · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.
- Product
- Open Journal Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 1, 2024File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameteCVE-2024-27747 · Other software · sourcecodester · reported by MITRECritical 9.8
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address paraCVE-2024-27746 · Other software · sourcecodester · reported by MITRECritical 9.8
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image paramCVE-2024-27744 · Other software · sourcecodester · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.
- Product
- petrol_pump_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parCVE-2024-27743 · Other software · petroleum_management_software_application_project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
- Product
- petroleum_management_software_application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobCVE-2023-46951 · Other software · contribsys · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.
- Product
- sidekiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi componenCVE-2024-26548 · Other software · vivotek · reported by MITRECritical 9.8
An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component.
- Product
- network_camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CVE-2024-25292 · Other software · Martinbarker · reported by MITRECritical 9.6
Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter.
- Product
- Rendertune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Mollie Payments for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2023-6090 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 7.3.11.
- Product
- Mollie Payments for WooCommerce
- Affected
- up to 7.3.11
- What to do
- Affects up to 7.3.11. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload CVE-2023-51802 · Other software · Oretnom23 · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the page or class_month parameter in the /php-attendance/attendance_report component.
- Product
- Simple Student Attendance System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parCVE-2023-51801 · Other software · simple_atudent_attendance_system · reported by MITRECritical 9.8
SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the student_form.php and the class_form.php pages.
- Product
- simple_atudent_attendance_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the CVE-2023-51800 · Other software · sourcecodester · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the main_settings component in the phone, address, bank, acc_name, acc_number parameters, new_class and cname parameter, add_new_parent function in the name email parameters, new_term function in the tname parameter, and the edit_student function in the name parameter.
- Product
- school_fees_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.CVE-2023-48650 · Other software · Concretecms · reported by MITREMedium 4.8
Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgconcretecms.org
Feb 28, 2024Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.CVE-2022-36677 · Other software · lynchjames · reported by MITREMedium 6.1
Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.
- Product
- obsidian-mindmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25435 · Other software · md1health · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Msg parameter.
- Product
- md1patient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request Forgery (CSRF)CVE-2023-51683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
- Product
- Easy PayPal & Stripe Buy Now Button
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request ForgeryCVE-2024-1719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal & Stripe Buy Now Button
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Gestpay for WooCommerce: Cross-Site Request ForgeryCVE-2024-0433 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_unset_default_card' function. This makes it possible for unauthenticated attackers to remove the default status of a card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Gestpay for WooCommerce
- Affected
- up to 20221130
- What to do
- Affects up to 20221130. Update Gestpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 28, 2024Gestpay for WooCommerce: Cross-Site Request ForgeryCVE-2024-0432 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_delete_card' function. This makes it possible for unauthenticated attackers to delete the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Gestpay for WooCommerce
- Affected
- up to 20221130
- What to do
- Affects up to 20221130. Update Gestpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 28, 2024Gestpay for WooCommerce: Cross-Site Request ForgeryCVE-2024-0431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_set_default_card' function. This makes it possible for unauthenticated attackers to set the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Gestpay for WooCommerce
- Affected
- up to 20221130
- What to do
- Affects up to 20221130. Update Gestpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 27, 2024In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service.CVE-2024-25398 · Other software · bulkstream · reported by MITREHigh 7.5
In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service.
- Product
- srelay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Feb 26, 2024SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php componenCVE-2024-24401 · Other software · nagios · reported by MITRECritical 9.8
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.
- Product
- nagios_xi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2024Piraeus Bank WooCommerce Payment Gateway: Time-based blind SQL InjectionCVE-2024-0610 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Piraeus Bank WooCommerce Payment Gateway
- Affected
- up to 1.6.5.1
- What to do
- Affects up to 1.6.5.1. Update Piraeus Bank WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2024An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.CVE-2023-51931 · Other software · alanclarke · reported by MITREHigh 7.5
An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.
- Product
- urlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 15, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection.CVE-2023-7081 · Other software · POSTAHSİL · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024.
- Product
- Online Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 15, 2024Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable.CVE-2023-6255 · Other software · Utarit Information Technologies · reported by iletisim@usom.gov.trHigh 7.5
Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This issue affects SoliPay Mobile App: before 5.0.8.
- Product
- SoliPay Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 15, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows CVE-2023-5155 · Other software · Utarit Information Technologies · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8.
- Product
- SoliPay Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 15, 2024Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users.CVE-2023-4993 · Other software · Utarit Information Technologies · reported by iletisim@usom.gov.trHigh 7.5
Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.
- Product
- SoliPay Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 15, 2024An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.CVE-2024-24386 · Other software · vitalpbx · reported by MITREHigh 7.2
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
- Product
- vitalpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorderickduarte.notion.sitegithub.com
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the NCVE-2024-25300 · Other software · Redaxo · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.
- Product
- Redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25226 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25225 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25224 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25221 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section parameter at /TaskManager/Tasks.php.
- Product
- Task Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25219 · Other software · task_manager_app · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php.
- Product
- task_manager_app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2024-25218 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php.
- Product
- Task Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at CVE-2024-25214 · Other software · sherlock · reported by MITRECritical 9.8
An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.
- Product
- employee_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CVE-2023-52059 · Other software · Gestsup · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
- Product
- Gestsup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settCVE-2023-52430 · Other software · Authcrunch · reported by MITREMedium 6.1
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.
- Product
- Caddy-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comgithub.com
Feb 10, 2024Pay with Vipps and MobilePay for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Hosting Pay with Vipps and MobilePay for WooCommerce allows Stored XSS.This issue affects Pay with Vipps and MobilePay for WooCommerce: from n/a through 1.14.13.
- Product
- Pay with Vipps and MobilePay for WooCommerce
- Affected
- up to 1.14.13
- What to do
- Affects up to 1.14.13. Update Pay with Vipps and MobilePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 8, 2024An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resultingCVE-2023-27001 · Other software · Egerie · reported by MITREHigh 8.8
An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
- Product
- Egerie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Payment Forms for Paystack: Stored Cross-Site ScriptingCVE-2023-5665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32130 is likely a duplicate of this issue.
- Product
- Payment Forms for Paystack
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.