Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 384 of 781
Oct 4, 2023Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored CVE-2023-4037 · Other software · Setelsa Security · reported by cve-coordination@incibe.esCritical 9.9
Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter.
- Product
- ConacWin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44208 · Other software · Acronis · reported by security@acronis.comCritical 9.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Oct 4, 2023SQL injection vulnerability in HelpDezk Community affecting version 1.1.10.CVE-2023-3038 · Other software · HelpDezk · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application.
- Product
- HelpDezk Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability.CVE-2023-3701 · Other software · Aqua eSolutions · reported by cve-coordination@incibe.esCritical 9.9
Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.
- Product
- Aqua Drive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop.CVE-2023-39647 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- Theme Volty CMS Category Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to verCVE-2023-39651 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- Theme Volty CMS Brandlist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop.CVE-2023-39649 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- Theme Volty CMS Category Slider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop.CVE-2023-39648 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- Theme Volty CMS Testimonial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop.CVE-2023-39646 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- Theme Volty CMS Category Chain Slider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2023-44974 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftCVE-2023-44973 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop.CVE-2023-39645 · Other software · Themevolty · reported by MITRECritical 9.8
Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- CMS Payment Icon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33273 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33272 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33271 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter common_name within the SSL Certificate check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33270 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33269 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An issue was discovered in DTS Monitoring 3.57.0.CVE-2023-33268 · Other software · DTS · reported by MITRECritical 9.8
An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind).
- Product
- Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.CVE-2023-40830 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.
- Product
- ac6_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comreference1.example.com
Oct 3, 2023Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload throuCVE-2023-32670 · Other software · BuddyBoss · reported by cve-coordination@incibe.esCritical 9
Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the "[name]=image.jpg" parameter, allowing to assign a persistent javascript payload that would be triggered when the associated image is loaded.
- Product
- BuddyBoss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023 SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.CVE-2023-5350 · Other software · salesagility · reported by security@huntr.devCritical 9.1
SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023There is a remote code execution vulnerability that affects all versions of NetMan 204.CVE-2022-47893 · Other software · Riello UPS · reported by cve-coordination@incibe.esCritical 10
There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.
- Product
- Netman-204
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023cashIT! - serving solutions.CVE-2023-3654 · Other software · PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH · reported by office@cyberdanube.comCritical 9.4
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
- Product
- cashIT! - serving solutions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023cashIT! - serving solutions.CVE-2023-3656 · Other software · PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH · reported by office@cyberdanube.comCritical 9.8
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
- Product
- cashIT! - serving solutions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.CVE-2023-33028 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 3, 2023Cryptographic issue in Data Modem due to improper authentication during TLS handshake.CVE-2023-28540 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 3, 2023Memory corruption in Modem while processing security related configuration before AS Security Exchange.CVE-2023-24855 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption in Modem while processing security related configuration before AS Security Exchange.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 2, 2023Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.CVE-2023-43980 · Other software · Presto-changeo · reported by MITRECritical 9.8
Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
- Product
- Testsitecreator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgpresto-changeo.com
Oct 2, 2023An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management cCVE-2023-44011 · Other software · Mojoportal · reported by MITRECritical 9.8
An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function.CVE-2023-43893 · Other software · netis-systems · reported by MITRECritical 9.8
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.
- Product
- n3m_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings.CVE-2023-43892 · Other software · netis-systems · reported by MITRECritical 9.8
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.
- Product
- n3m_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function.CVE-2023-43891 · Other software · netis-systems · reported by MITRECritical 9.8
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
- Product
- n3m_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.CVE-2023-44009 · Other software · Mojoportal · reported by MITRECritical 9.8
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commojoportal.com
Oct 2, 2023File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.CVE-2023-44008 · Other software · Mojoportal · reported by MITRECritical 9.8
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply byCVE-2023-4659 · Other software · Free5Gc · reported by cve-coordination@incibe.esCritical 9.8
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.
- Product
- Open5Gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Server-Side Request Forgery vulnerability in SLims version 9.6.0.CVE-2023-3744 · Other software · SLiMS · reported by cve-coordination@incibe.esCritical 9.9
Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
- Product
- SLiMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2023In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20819 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comCritical 9.8
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY01068234; Issue ID: ALPS08010003.
- Product
- MT2731, MT6570, MT6580, MT6595, MT6732, MT6735, MT6737, MT6737M, MT6738, MT6739, MT6750, MT6750S, MT6752, MT6753, MT6755, MT6757, MT6758, MT6761, MT6762, MT6762
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Sep 29, 2023OpenHook: Remote Code ExecutionCVE-2023-5201 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site.
- Product
- OpenHook
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update OpenHook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 29, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2023-5227 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.CVE-2023-43909 · Other software · hospital_management_system · reported by MITRECritical 9.1
Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
- Product
- hospital_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023 A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings.CVE-2023-5288 · Other software · SICK AG · reported by psirt@sick.deCritical 9.8
A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload a new firmware version to the device.
- Product
- SIM1012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023TorchServe is a tool for serving and scaling PyTorch models in production.CVE-2023-43654 · Other software · pytorch · reported by GitHubCritical 10
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 28, 2023The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44166 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44164 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44163 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-43739 · Other software · Online Book Store Project · reported by help@fluidattacks.comCritical 9.8
The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Book Store Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authentiCVE-2023-5185 · Other software · Gym Management System Project · reported by help@fluidattacks.comCritical 9.1
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
- Product
- Gym Management System Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023Hospital management system version 378c157 allows to bypass authentication.CVE-2023-5053 · Other software · hospital-management-system · reported by help@fluidattacks.comCritical 9.8
Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
- Product
- hospital-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 28, 2023Hospital management system version 378c157 allows to bypass authentication.CVE-2023-5004 · Other software · Hospital-management-system · reported by help@fluidattacks.comCritical 9.8
Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
- Product
- Hospital-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 28, 2023Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an externalCVE-2023-43013 · Other software · Asset Management System · reported by help@fluidattacks.comCritical 9.8
Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
- Product
- Asset Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.