Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 33 of 87
Jan 15, 2025A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical.CVE-2025-0492 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Jan 15, 2025A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0.CVE-2025-0491 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/cat_dodel.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0.CVE-2025-0490 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /fladmin/article_dodel.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0.CVE-2025-0489 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0.CVE-2025-0488 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical.CVE-2025-0484 · Other software · Fanli2012 · reported by VulDBMedium 6.9
A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig_doedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic.CVE-2025-0483 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump.php. The manipulation of the argument message/error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0.CVE-2025-0482 · Other software · Fanli2012 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as problematic has been found in D-Link DIR-878 1.03.CVE-2025-0481 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP POST Request Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-878
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as problematic has been found in wuzhicms 4.1.0.CVE-2025-0480 · Other software · Wuzhicms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical.CVE-2025-0462 · Other software · Shanghai Lingdang Information Technology · reported by VulDBMedium 5.3
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic.CVE-2025-0461 · Other software · Shanghai Lingdang Information Technology · reported by VulDBMedium 5.3
A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart.CVE-2025-0460 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jan 14, 2025A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows.CVE-2025-0459 · Other software · libretro · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RetroArch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1.CVE-2025-0458 · Other software · Virtual Computer · reported by VulDBMedium 6.9
A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vysual RH Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical was found in liujianview gymxmjpa 1.0.CVE-2025-0410 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0.CVE-2025-0409 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical.CVE-2025-0405 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java. The manipulation of the argument goodsName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical.CVE-2025-0404 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the argument coachName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0.CVE-2025-0403 · Other software · 1902756969 · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file /user/sendMsg of the component Phone Number Validation Handler. The manipulation of the argument code leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- reggie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical was found in 1902756969 reggie 1.0.CVE-2025-0402 · Other software · 1902756969 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- reggie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical has been found in 1902756969 reggie 1.0.CVE-2025-0401 · Other software · 1902756969 · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- reggie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic.CVE-2025-0398 · Other software · longpi1 · reported by VulDBMedium 5.1
A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /resources/..;/inport/updateInport of the component Backend. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability, which was classified as problematic, was found in reckcn SPPanAdmin 1.0.CVE-2025-0397 · Other software · reckcn · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in reckcn SPPanAdmin 1.0. Affected is an unknown function of the file /;/admin/role/edit. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SPPanAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21.CVE-2025-0396 · Other software · exelban · reported by VulDBHigh 8.5
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0392 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0391 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0390 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16.CVE-2025-0349 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- AC6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0345 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0344 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0334 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0.CVE-2025-0333 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2.CVE-2025-0331 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2025A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0.CVE-2025-0328 · Other software · KaiYuanTong · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ECT Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 8, 2025A vulnerability classified as problematic was found in SingMR HouseRent 1.0.CVE-2024-13213 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in SingMR HouseRent 1.0. This vulnerability affects unknown code of the file /toAdminUpdateHousePage?hID=30. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as critical has been found in SingMR HouseRent 1.0.CVE-2024-13212 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux.CVE-2024-13206 · Other software · REVE · reported by VulDBHigh 8.5
A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp/reveinstall. The manipulation leads to incorrect default permissions. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic.CVE-2024-13202 · Other software · wander-chu · reported by VulDBMedium 5.1
A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/java/com/my/blog/website/controller/admin/PageController.java of the component Blog Article Handler. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- SpringBoot-Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical.CVE-2024-13201 · Other software · wander-chu · reported by VulDBMedium 5.1
A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/main/java/com/my/blog/website/controller/admin/AttachtController.java of the component Admin Attachment Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SpringBoot-Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0.CVE-2024-13200 · Other software · wander-chu · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SpringBoot-Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0.CVE-2024-13199 · Other software · langhsu · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file /search of the component Search Bar. The manipulation of the argument kw leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mblog Blog System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0.CVE-2024-13198 · Other software · langhsu · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mblog Blog System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability was found in Sucms 1.0 and classified as critical.CVE-2024-13194 · Other software · Sucms Project · reported by VulDBMedium 5.3
A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac=search. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Sucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.CVE-2024-13193 · Other software · Sem-cms · reported by VulDBMedium 5.3
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0.CVE-2024-13192 · Other software · ZeroWdd · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0. Affected is the function update of the file src/main/java/com/wdd/myblog/controller/admin/BlogController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- myblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0.CVE-2024-13191 · Other software · ZeroWdd · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- myblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as critical was found in ZeroWdd myblog 1.0.CVE-2024-13190 · Other software · ZeroWdd · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMapper.xml. The manipulation of the argument findBlogList/getTotalBlogs leads to xml injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- myblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as critical has been found in ZeroWdd myblog 1.0.CVE-2024-13189 · Other software · ZeroWdd · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- myblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic.CVE-2024-8002 · Other software · VIWIS · reported by VulDBMedium 6.9
A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 9.12 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.