Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,399 results · page 38 of 68

Dec 26, 2023Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo.CVE-2023-51101 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo.
Product
W9 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 26, 2023Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .CVE-2023-51098 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .
Product
W9 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 26, 2023Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.CVE-2023-51097 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.
Product
W9 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 25, 2023An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1.CVE-2023-28616 · Other software · Stormshield · reported by MITREHigh 7.5
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.
Product
Stormshield Network Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.stormshield.eu advisories.stormshield.eu
Dec 25, 2023An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 throCVE-2023-47091 · Other software · Stormshield · reported by MITREHigh 7.5
An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.
Product
Stormshield Network Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.stormshield.eu advisories.stormshield.eu
Dec 20, 2023An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0.CVE-2023-47093 · Other software · Stormshield · reported by MITREMedium 6.5
An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine.
Product
Stormshield Network Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.stormshield.eu advisories.stormshield.eu
Dec 20, 2023An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0CVE-2023-41166 · Other software · Stormshield · reported by MITREMedium 5.3
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.
Product
Stormshield Network Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.stormshield.eu advisories.stormshield.eu
Dec 20, 2023BSK Forms Blacklist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30872 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.
Product
BSK Forms Blacklist
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Gravity Forms: Deserialization of Untrusted DataCVE-2023-28782 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
Product
Gravity Forms
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-37982 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Forms by CaptainForm – Form Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – Form Builder for WordPress allows Reflected XSS.This issue affects Forms by CaptainForm – Form Builder for WordPress: from n/a through 2.5.3.
Product
Forms by CaptainForm – Form Builder for
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Forms by CaptainForm – Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as wheCVE-2023-42183 · Other software · Lockss · reported by MITREMedium 5.3
lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.
Product
Classic Lockss Daemon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 14, 2023Optin Forms – Simple List Building Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49841 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress allows Stored XSS.This issue affects Optin Forms – Simple List Building Plugin for WordPress: from n/a through 1.3.3.
Product
Optin Forms – Simple List Building Plugin for
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Optin Forms – Simple List Building Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.CVE-2023-40655 · Other software · mooj.org · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
Product
Proforms Basic component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.joomla.org extensions.joomla.org
Dec 12, 2023Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.CVE-2023-49994 · Other software · Espeak-ng · reported by MITREMedium 5.5
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.
Product
Espeak-ng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
Dec 8, 2023An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms.CVE-2023-6507 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.1
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Product
CPython
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2023Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-47779 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
Product
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Ninja Forms Contact Form – The Drag and Drop Form Builder for: Uncontrolled Resource ConsumptionCVE-2023-35909 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 5, 2023Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic CVE-2021-27795 · Other software · Brocade · reported by sirt@brocade.comMedium 6.4
Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic issues that could allow for the installation of forged or fraudulent license keys. This would allow attackers or a malicious party to forge a counterfeit license key that the Brocade Fabric OS platform would authenticate and activate as if it were a legitimate license key.
Product
Brocade Switches
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Dec 5, 2023A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows theCVE-2023-28875 · Other software · Afian · reported by MITREMedium 5.4
A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.
Product
Filerun
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filerun.com herolab.usd.de
Dec 5, 2023On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local lCVE-2023-24547 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.9
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config.
Product
MOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arista.com arista.com
Dec 5, 2023 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.CVE-2023-44298 · Other software · Dell · reported by security_alert@emc.comLow 3.6
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service.
Product
PowerEdge BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Dec 5, 2023 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.CVE-2023-44297 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information disclosure, information tampering, code execution, denial of service.
Product
PowerEdge BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Nov 30, 2023Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9.
Product
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
Affected
up to 1.25.9
What to do
Affects up to 1.25.9. Update Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023WP Forms Puzzle Captcha: Cross-Site Request Forgery (CSRF)CVE-2023-48278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Cross-Site Request Forgery (CSRF)CVE-2023-47645 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Cross Site Request Forgery.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.2.6.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.2.2.6
What to do
Affects up to 5.2.2.6. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 29, 2023An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.CVE-2023-3741 · Other software · NEC Platforms, Ltd · reported by psirt-info@cyber.jp.nec.comCritical 9.8
An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.
Product
ITK-6DGS-1(BK) TEL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https https
Nov 27, 2023Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName.CVE-2023-49047 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName.
Product
Ax1803 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by CVE-2023-47816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.
Affected
up to 1.7.0.13
What to do
Affects up to 1.7.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3CVE-2023-47824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.
Fixed in
1.3.9
What to do
Update the plugin to 1.3.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5417 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5415 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5411 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values. Note that the extent of modification is limited due to fixed values passed to the wp_update_post function.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5386 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin. CVE-2023-5990 appears to be a duplicate of this issue.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5385 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbitrary posts.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Cross-Site Request ForgeryCVE-2023-5383 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-5990 appears to be a duplicate of this issue.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Cross-Site Request ForgeryCVE-2023-5382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2023Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm fuCVE-2023-38823 · Network & remote access · Tenda · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm function in bin/httpd.
Product
Ac6 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin CVE-2023-47669 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.10.3 versions.
Fixed in
3.10.4
What to do
Update the plugin to 3.10.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.CVE-2023-47230 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Form Builder | Create Responsive Contact Forms: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23796 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
Product
Form Builder | Create Responsive Contact Forms
Affected
up to 1.9.9.0
What to do
Affects up to 1.9.9.0. Update Form Builder | Create Responsive Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.CVE-2023-47102 · Other software · urbackup · reported by MITREMedium 5.3
UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.
Product
urbackup_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nitipoom-jaroonchaipipat.github.io quantiano.github.io
Nov 6, 2023WooCommerce Ninja Forms Product Add-ons: Does not validate the file to be uploadedCVE-2023-5601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
Product
WooCommerce Ninja Forms Product Add-ons
Fixed in
1.7.1
What to do
Update WooCommerce Ninja Forms Product Add-ons to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Product
Ninja Forms Contact Form
Fixed in
3.6.34
What to do
Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD record ninjaforms.com wpscan.com
Nov 2, 2023IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new wCVE-2023-43018 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163.
Product
CICS TX Standard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 2, 2023IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting.CVE-2023-42029 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.8
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059.
Product
CICS TX Standard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 2, 2023IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an CVE-2023-42027 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 266057.
Product
CICS TX Standard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.