Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 37 of 73
Jul 25, 2022W-DALIL: Does not sanitise and escape some of its fieldsCVE-2022-2340 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- W-DALIL
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update W-DALIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 18, 2022The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.CVE-2022-34635 · Other software · Openhwgroup · reported by MITRECritical 9.8
The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.
- Product
- Cva6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2022404s: Does not sanitise and escape its fieldsCVE-2022-2118 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- 404s
- Fixed in
- 3.5.1
- What to do
- Update 404s to 3.5.1 or newer.
Jul 7, 2022The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function.CVE-2022-32567 · Other software · Appfire · reported by MITREMedium 5.4
The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function.
- Product
- Jira Misc Custom Fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarketplace.atlassian.comsyss.de
Jul 6, 2022Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server.CVE-2022-26348 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.2
Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jul 1, 2022MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.CVE-2022-32086 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orgsecurity.netapp.com
Jun 30, 2022Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-CVE-2022-34777 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins GitLab Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and CCVE-2022-32969 · Other software · Metamask · reported by MITREMedium 5.9
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.
- Product
- Metamask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Image Gallery: Does not sanitize and escape some of its Image fieldsCVE-2022-1327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Image Gallery
- Fixed in
- 1.1.6
- What to do
- Update Image Gallery to 1.1.6 or newer.
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 23, 2022Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog moCVE-2022-33113 · Other software · Jflyfox · reported by MITREMedium 5.4
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-31303 · Other software · Maccms · reported by MITREMedium 5.4
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-31302 · Other software · Maccms · reported by MITREMedium 5.4
maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components.CVE-2022-23074 · Other software · recipes · reported by vulnerabilitylab@mend.ioLow 3.5
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.CVE-2021-36609 · Other software · Webtareas Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 16, 2022Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.CVE-2021-36608 · Other software · Webtareas Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=.CVE-2022-32353 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.CVE-2022-32366 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=.CVE-2022-32365 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial ICVE-2021-35073 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 13, 2022Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is acceCVE-2022-33175 · Other software · Powertekpdus · reported by MITRECritical 9.8
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
- Product
- Basic PDU Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgynvael.coldwind.plgynvael.coldwind.pl
Jun 13, 2022A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2022-31398 · Other software · Helpdeskz · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Appointment Hour Booking: Does not sanitise and escape a settings of its Calendar fieldsCVE-2022-1710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.56
- What to do
- Update Appointment Hour Booking to 1.3.56 or newer.
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- Product
- WP-CRM
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.CVE-2022-31325 · Other software · Churchcrm · reported by MITREHigh 7.2
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 8, 2022A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.CVE-2022-30899 · Other software · Partkeepr · reported by MITREMedium 4.8
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
- Product
- Partkeepr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022FormCraft: Does not sanitise and escape Field LabelsCVE-2022-1647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- FormCraft
- Fixed in
- 1.2.6
- What to do
- Update FormCraft to 1.2.6 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022WP Born Babies: Does not sanitise and escape some of its fieldsCVE-2022-1506 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Born Babies
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Born Babies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
Jun 7, 2022Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with acceCVE-2021-35531 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.7
Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
- Product
- TXpert Hub CoreTec 4 version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 6, 2022FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.CVE-2022-30861 · Other software · Fudforum · reported by MITREMedium 4.8
FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to acceCVE-2022-30496 · Other software · MV · reported by MITREHigh 7.5
SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to access enterprise's private and sensitive information.
- Product
- Idce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
May 30, 2022Birthdays Widget: Does not sanitise and escape some of its fieldsCVE-2022-1643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Birthdays Widget
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update Birthdays Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 26, 2022In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackCVE-2022-30494 · Other software · Automotive Shop Management System Project · reported by MITREMedium 5.4
In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs.
- Product
- Automotive Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022A vulnerability has been found in Airfield Online and classified as problematic.CVE-2021-4230 · Other software · unspecified · reported by VulDBLow 3.7
A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.
- Product
- Airfield Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like FuCVE-2022-30015 · Other software · Simple Food Website Project · reported by MITREMedium 5.4
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
- Product
- Simple Food Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 21, 2022Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3AtextCVE-2022-31267 · Other software · Gitblit · reported by MITRECritical 9.8
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
- Product
- Gitblit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page.CVE-2022-25229 · Other software · Popcorn Time Project · reported by help@fluidattacks.comMedium 5.4
Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
- Product
- Popcorn Time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
May 19, 2022Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtCVE-2020-16235 · Other software · Emerson · reported by ics-cert@hq.dhs.govLow 3.8
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.
- Product
- Open Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to oCVE-2020-16209 · Other software · Fieldcomm Group · reported by ics-cert@hq.dhs.govCritical 9.8
A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.
- Product
- HART-IP Developer Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.CVE-2022-30597 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.3
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
May 18, 2022ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while CVE-2022-23068 · Other software · ToolJet · reported by vulnerabilitylab@mend.ioMedium 5.4
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.
- Product
- ToolJet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
May 18, 2022In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a CVE-2021-41946 · Other software · Fiberhome · reported by MITREMedium 5.4
In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS.
- Product
- Hg150-ub Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiberhome.comgithub.com
May 16, 2022Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field.CVE-2022-1731 · Other software · Allgeier · reported by vulnreport@tenable.comCritical 9.8
Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist.
- Product
- Metasonic DOC Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 16, 2022WP Subtitle: Adds a subtitle field and provides a shortcode to display it via [wp_subtitle]CVE-2022-1393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.
- Product
- WP Subtitle
- Fixed in
- 3.4.1
- What to do
- Update WP Subtitle to 3.4.1 or newer.
May 9, 2022IgniteUp: Does not sanitise and escape some fieldsCVE-2022-0898 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
- Product
- IgniteUp
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update IgniteUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 5, 2022A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an ICVE-2021-25745 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 7.6
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
- Product
- Kubernetes ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
May 3, 2022A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pagesCVE-2022-28589 · Other software · Pixelimity · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=add_new
- Product
- Pixelimity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.