Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39,009 results · page 386 of 781
Sep 25, 2023WP Job Portal: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-4490 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
- Product
- WP Job Portal
- Fixed in
- 2.0.6
- What to do
- Update WP Job Portal to 2.0.6 or newer.
Sep 25, 2023TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.CVE-2023-43141 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
- Product
- a3700r
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1.CVE-2023-40163 · Other software · Accusoft · reported by talos-cna@cisco.comCritical 9.8
An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- ImageGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 25, 2023A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1.CVE-2023-39453 · Other software · Accusoft · reported by talos-cna@cisco.comCritical 9.8
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can deliver this file to trigger this vulnerability.
- Product
- ImageGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 25, 2023A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1.CVE-2023-35002 · Other software · Accusoft · reported by talos-cna@cisco.comCritical 9.8
A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- ImageGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 25, 2023An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1.CVE-2023-32653 · Other software · Accusoft · reported by talos-cna@cisco.comCritical 9.8
An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
- Product
- ImageGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 25, 2023General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.CVE-2023-43131 · Other software · maxiguvenlik · reported by MITRECritical 9.8
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.
- Product
- general_device_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 25, 2023Input verification vulnerability in the fingerprint module.CVE-2022-48605 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 25, 2023An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.CVE-2023-41419 · Other software · Gevent · reported by MITRECritical 9.8
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
- Product
- Gevent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023Vulnerability of defects introduced in the design process in the HiviewTunner module.CVE-2023-41297 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 25, 2023Vulnerability of missing authorization in the kernel module.CVE-2023-41296 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 25, 2023The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.CVE-2023-41294 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Sep 25, 2023The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.CVE-2023-39407 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Sep 22, 2023SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.CVE-2023-43470 · Other software · Janobe · reported by MITRECritical 9.8
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.
- Product
- Online Voting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2023SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.CVE-2023-43469 · Other software · Online JOB Portal Project · reported by MITRECritical 9.8
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2023SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.CVE-2023-43468 · Other software · Online JOB Portal Project · reported by MITRECritical 9.8
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2023Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().CVE-2023-43338 · Other software · Cesanta · reported by MITRECritical 9.8
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2023D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.CVE-2023-43130 · Network & remote access · d-link · reported by MITRECritical 9.8
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.
- Product
- dir-806_1200m11ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddlink.com.cngithub.com
Sep 22, 2023D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters.CVE-2023-43129 · Network & remote access · d-link · reported by MITRECritical 9.8
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters.
- Product
- dir-806_1200m11ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddlink.com.cngithub.com
Sep 22, 2023SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecCVE-2023-40989 · Other software · Jeecg · reported by MITRECritical 9.8
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2023dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.CVE-2023-43270 · Other software · Dst-admin Project · reported by MITRECritical 9.8
dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.
- Product
- Dst-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2023Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend).CVE-2023-43762 · Other software · withsecure · reported by MITRECritical 9.8
Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Manager Proxy 15.
- Product
- f-secure_policy_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Sep 21, 2023FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.CVE-2023-31719 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.CVE-2023-43128 · Network & remote access · d-link · reported by MITRECritical 9.8
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
- Product
- dir806a1_fw100cnb11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddlink.com.cngithub.com
Sep 21, 2023SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.CVE-2023-34576 · Other software · Store-opart · reported by MITRECritical 9.8
SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.
- Product
- Op'art Product FAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 21, 2023systeminformation is a System Information Library for Node.JS.CVE-2023-42810 · Other software · sebhildebrandt · reported by GitHubCritical 9.8
systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.CVE-2023-42279 · Other software · Iteachyou · reported by MITRECritical 9.8
Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredpacketsecurity.com
Sep 21, 2023SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleCVE-2023-34577 · Other software · Planned Popup Project · reported by MITRECritical 9.8
SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleFrontController::prepareHook() method.
- Product
- Planned Popup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 21, 2023 As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clieCVE-2023-43632 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioCritical 9
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communication with this server is done using protobuf, and the data is comprised of 2 parts: 1. Header 2. Data When a connection is made, the server is waiting for 4 bytes of data, which will be the header, and these 4 bytes would be parsed as uint32 size of the actual data to come. Then, in the function “handleRequest” this size is then used in order to allocate a payload on the stack for the incoming data. As this payload is allocated on the stack, this will allow overflowing the stack size allocated for the relevant process with freely controlled data. * An attacker can crash the system. * An attacker can gain control over the system, specifically on the “vtpm_server” process which has very high privileges.
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel.CVE-2023-43242 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.CVE-2023-43241 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.
- Product
- dir-823g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.CVE-2023-43240 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
- Product
- dir-816_a2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.CVE-2023-43239 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.CVE-2023-43238 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.CVE-2023-43237 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.CVE-2023-43236 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.
- Product
- dir-816_a2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.CVE-2023-43235 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.
- Product
- dir-823g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulatCVE-2023-4291 · Other software · Frauscher · reported by info@cert.vde.comCritical 9.8
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device.
- Product
- FDS101 for FAdC/FAdCi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Sep 21, 2023web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.CVE-2015-5467 · Other software · Yiiframework · reported by MITRECritical 9.8
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comyiiframework.com
Sep 20, 2023There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of thCVE-2023-43135 · Network & remote access · tp-link · reported by MITRECritical 9.8
There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
- Product
- er5120g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.CVE-2023-39675 · Other software · Myprestamodules · reported by MITRECritical 9.8
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
- Product
- Product Catalog (csv, Excel) Import
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iesorcery.ie
Sep 20, 2023Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerrCVE-2023-36109 · Other software · Jerryscript · reported by MITRECritical 9.8
Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontCCVE-2023-34575 · Other software · Store-opart · reported by MITRECritical 9.8
SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods.
- Product
- Op'art Save Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 20, 2023Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.CVE-2023-42322 · Other software · Icmsdev · reported by MITRECritical 9.8
Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Sep 20, 2023There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authenCVE-2023-43134 · Other software · netis-systems · reported by MITRECritical 9.8
There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
- Product
- 360rac1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, gCVE-2023-43375 · Other software · Digitaldruid · reported by MITRECritical 9.8
Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Sep 20, 2023Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.CVE-2023-43374 · Other software · Digitaldruid · reported by MITRECritical 9.8
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Sep 20, 2023Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.CVE-2023-43373 · Other software · Digitaldruid · reported by MITRECritical 9.8
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Sep 20, 2023Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.CVE-2023-43371 · Other software · Digitaldruid · reported by MITRECritical 9.8
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Sep 20, 2023phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directlCVE-2023-40619 · Websites & servers · Phppgadmin Project · reported by MITRECritical 9.8
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
- Product
- Phppgadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.