Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 36 of 87
Nov 25, 2024A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0.CVE-2024-11674 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 25, 2024A vulnerability, which was classified as critical, has been found in eNMS up to 4.2.CVE-2024-11664 · Other software · enms · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file eNMS/controller.py of the component TGZ File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 22b0b443acca740fc83b5544165c1f53eff3f529. It is recommended to apply a patch to fix this issue.
- Product
- enms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0.CVE-2024-11663 · Websites & servers · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument keywords leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical.CVE-2024-11659 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_iperf. The manipulation of the argument iperf leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 25, 2024A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical.CVE-2024-11658 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/network/ajax_getChannelList. The manipulation of the argument countryCode leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 25, 2024A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118.CVE-2024-11657 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of the file /admin/network/diag_nslookup. The manipulation of the argument diag_nslookup leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 25, 2024A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118.CVE-2024-11656 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unknown processing of the file /admin/network/diag_ping6. The manipulation of the argument diag_ping6 leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 25, 2024A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118.CVE-2024-11655 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the file /admin/network/diag_pinginterface. The manipulation of the argument diag_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 24, 2024A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118.CVE-2024-11654 · Other software · EnGenius · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ENH1350EXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordk9u7kv33ub.feishu.cnvuldb.com
Nov 24, 2024A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical.CVE-2024-11650 · Network & remote access · Tenda · reported by VulDBHigh 7.1
A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- i9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical.CVE-2024-11630 · Other software · E-Lins · reported by VulDBMedium 6.9
A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability affects unknown code of the component OEM Backend. The manipulation leads to hard-coded credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- H685
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3.CVE-2024-11619 · Other software · macrozheng · reported by VulDBLow 2.3
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.
- Product
- mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027.CVE-2024-11618 · Other software · IPC · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Unigy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024WPAdverts – Classifieds: Reflected Cross-Site ScriptingCVE-2024-10890 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024A vulnerability classified as problematic was found in 115cms up to 20240807.CVE-2024-11493 · Other software · 115cms · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/pageAE.html. The manipulation of the argument tid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 115cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability classified as problematic has been found in 115cms up to 20240807.CVE-2024-11492 · Other software · 115cms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 115cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability was found in 115cms up to 20240807 and classified as problematic.CVE-2024-11488 · Other software · 115cms · reported by VulDBMedium 5.3
A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_user.html. The manipulation of the argument ks leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 115cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical.CVE-2024-11487 · Other software · Code4Berry · reported by VulDBMedium 5.3
A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /decoration/admin/btndates_report.php of the component Between Dates Reports. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Decoration Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0.CVE-2024-11486 · Other software · Code4Berry · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decoration/admin/user_permission.php of the component User Permission Handler. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Decoration Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0.CVE-2024-11485 · Other software · Code4Berry · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functionality of the file /decoration/admin/userregister.php of the component User Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Decoration Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0.CVE-2024-11484 · Other software · Code4Berry · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /decoration/admin/update_image.php of the component User Image Handler. The manipulation of the argument productimage1 leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Decoration Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Classified Listing – Classified ads & Business Directory: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11194 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.15.1
- What to do
- Affects up to 3.1.15.1. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 17, 2024A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108.CVE-2024-11306 · Other software · Altenergy · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processing of the file /index.php/display/database/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Power Control Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2024A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108.CVE-2024-11305 · Other software · Altenergy · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Power Control Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2024Classified Listing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-52386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 3.1.16.
- Product
- Classified Listing
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical.CVE-2024-11248 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Nov 15, 2024A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic.CVE-2024-11240 · Other software · IBPhoenix · reported by VulDBMedium 5.3
A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.php of the component Banco de Dados Tab. The manipulation of the argument db_login_role leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ibWebAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Nov 15, 2024A vulnerability has been found in Landray EKP up to 16.0 and classified as critical.CVE-2024-11239 · Other software · Landray · reported by VulDBMedium 5.3
A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common/import.do?method=deleteFile of the component API Interface. The manipulation of the argument folder leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EKP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0.CVE-2024-11238 · Other software · Landray · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EKP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021.CVE-2024-11237 · Network & remote access · TP-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- VN020 F3v(T)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A vulnerability classified as critical has been found in EyouCMS up to 1.6.7.CVE-2024-11211 · Other software · Eyoucms · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A vulnerability was found in Apereo CAS 6.6 and classified as problematic.CVE-2024-11208 · Other software · Apereo · reported by VulDBMedium 6.3
A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A vulnerability has been found in Apereo CAS 6.6 and classified as problematic.CVE-2024-11207 · Other software · Apereo · reported by VulDBMedium 5.3
A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login. The manipulation of the argument redirect_uri leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Nov 13, 2024A vulnerability was found in Public CMS 5.202406.d and classified as problematic.CVE-2024-11175 · Other software · Public · reported by VulDBMedium 5.3
A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.116.CVE-2024-11138 · Other software · dedecms · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic.CVE-2024-11125 · Other software · get-simple · reported by VulDBMedium 6.9
A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical.CVE-2024-11124 · Other software · TimGeyssens · reported by VulDBMedium 5.1
A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- UIOMatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11123 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/pdf.php. The manipulation of the argument url with the input ../config.inc.php leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11122 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functionality of the file /crm/wechatSession/index.php?msgid=1&operation=upload. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11121 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this vulnerability is an unknown functionality of the file /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d.CVE-2024-11070 · Other software · Sanluan · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Image Classify: Unrestricted Upload of File with Dangerous TypeCVE-2024-51789 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in UjW0L Image Classify image-classify allows Upload a Web Shell to a Web Server.This issue affects Image Classify: from n/a through <= 1.0.0.
- Product
- Image Classify
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Image Classify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2024A vulnerability classified as critical was found in Tenda AC10 16.03.10.13.CVE-2024-11061 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN_0044db3c of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Nov 10, 2024A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0.CVE-2024-11060 · Other software · Jinher Network · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of the file /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Collaborative Management Platform 金和数字化智能办公平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2024A vulnerability has been found in Codezips Hospital Appointment System 1.0 and classified as critical.CVE-2024-11057 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability has been found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /removeBranchResult.php. The manipulation of the argument ID/Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hospital Appointment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2024A vulnerability, which was classified as critical, was found in Tenda AC10 16.03.10.13.CVE-2024-11056 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in Tenda AC10 16.03.10.13. Affected is the function FUN_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Nov 10, 2024A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic.CVE-2024-11050 · Other software · AMTT · reported by VulDBMedium 5.3
A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic. This issue affects some unknown processing of the file /language.php. The manipulation of the argument LangID/LangName/LangEName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hotel Broadband Operation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2024A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1.CVE-2024-11049 · Other software · ZKTeco · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the component Image File Handler. The manipulation leads to direct request. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZKBio Time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.comvuldb.com
Nov 8, 2024A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0.CVE-2024-11000 · Other software · CodeAstro · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.