Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
340 results · page 4 of 7
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in theCVE-2018-15188 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.5
PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in the Name field of a profile.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.CVE-2018-15187 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 8
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.CVE-2018-15186 · Other software · Chartered Accountant \ · reported by MITREHigh 8.8
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2018PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaSCVE-2018-15185 · Other software · Naukri Clone Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaScript code in the "Current Position" field.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.CVE-2018-15184 · Other software · Naukri Clone Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.CVE-2018-15183 · Other software · Myperfectresume / Jobhero / Resume Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.
- Product
- Myperfectresume / Jobhero / Resume Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.CVE-2018-15182 · Other software · CAR Rental Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2018PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.CVE-2018-14541 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
- Product
- Basic B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Jul 18, 2018PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.CVE-2018-14082 · Other software · Freelancewebdesignerchennai · reported by MITREMedium 5.4
PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.
- Product
- JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Jul 9, 2018PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.CVE-2018-13256 · Other software · Chartered Accountant \ · reported by MITREMedium 6.1
PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Jun 8, 2018Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.php, photo_gallery.phpCVE-2018-12055 · Other software · Schools Alert Management Script Project · reported by MITRECritical 9.8
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, and so on.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 8, 2018Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.CVE-2018-12054 · Other software · Schools Alert Management Script Project · reported by MITREHigh 7.5
Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 8, 2018Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversal.CVE-2018-12053 · Other software · Schools Alert Management Script Project · reported by MITREHigh 7.5
Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversal.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 8, 2018SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.CVE-2018-12052 · Other software · Schools Alert Management Script Project · reported by MITRECritical 9.8
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 8, 2018Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as demonstrateCVE-2018-12051 · Other software · Schools Alert Management Script Project · reported by MITRECritical 9.8
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2018PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changinCVE-2018-11514 · Other software · Naukri Clone Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitehatck01.blogspot.comwhitehatck01.blogspot.com
May 26, 2018PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.CVE-2018-11501 · Other software · Website Seller Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comwhitehatck01.blogspot.com
Apr 12, 2018PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.CVE-2018-6935 · Other software · Student Profile Management System Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.
- Product
- Student Profile Management System Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.CVE-2018-6934 · Other software · Ordermanagementscript · reported by MITREHigh 8.8
CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.
- Product
- Online Tutoring Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.CVE-2018-6904 · Other software · CAR Rental Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modiCVE-2018-6903 · Other software · HOT Scripts Clone Project · reported by MITREHigh 8.8
PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code.
- Product
- HOT Scripts Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.CVE-2018-6902 · Other software · Image Sharing Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.
- Product
- Image Sharing Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.CVE-2018-6900 · Other software · Website Broker Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.
- Product
- Website Broker Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registerCVE-2018-6879 · Other software · Website Seller Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 12, 2018Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.CVE-2018-6870 · Other software · Website Seller Script Project · reported by MITREMedium 6.1
Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 9, 2018PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).CVE-2018-9857 · Other software · Match Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
- Product
- Match Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comexploit-db.com
Apr 5, 2018PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.CVE-2018-9328 · Other software · Redbus Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.
- Product
- Redbus Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Mar 6, 2018PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User.CVE-2018-7650 · Other software · HOT Scripts Clone Project · reported by MITREMedium 4.8
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript code to the user's browser. This is different from CVE-2018-6878.
- Product
- HOT Scripts Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.inneetech18.blogspot.in
Feb 28, 2018PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - ICVE-2018-7469 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - Industry Type).
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.inneetech18.blogspot.in
Feb 28, 2018SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php.CVE-2018-7477 · Other software · School Management Script Project · reported by MITRECritical 9.8
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php.
- Product
- School Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 23, 2018SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter.CVE-2018-6859 · Other software · Schools Alert Management Script Project · reported by MITRECritical 9.8
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.comexploit-db.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.CVE-2018-6868 · Other software · Groupon Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
- Product
- Groupon Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.CVE-2018-6867 · Other software · Alibaba Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
- Product
- Alibaba Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgithub.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.CVE-2018-6866 · Other software · Learning And Examination Management System Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.
- Product
- Learning And Examination Management System Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 20, 2018Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.CVE-2015-2081 · Other software · Datto · reported by MITRECritical 9.8
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
- Product
- Alto 3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinformation-paradox.netinformation-paradox.net
Feb 13, 2018PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.CVE-2018-6928 · Other software · News Website Script Project · reported by MITRECritical 9.8
PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.
- Product
- News Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.CVE-2018-6864 · Other software · Multireligion Responsive Matrimonial Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.
- Product
- Multireligion Responsive Matrimonial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter.CVE-2018-6863 · Other software · Select Your College Script Project · reported by MITRECritical 9.8
SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter.
- Product
- Select Your College Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.CVE-2018-6862 · Other software · Bitcoin MLM Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.
- Product
- Bitcoin MLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.CVE-2018-6861 · Other software · Lawyer Search Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.
- Product
- Lawyer Search Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.CVE-2018-6860 · Other software · Schools Alert Management Script Project · reported by MITREHigh 8.8
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.
- Product
- Schools Alert Management Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.CVE-2018-6858 · Other software · Facebook Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
- Product
- Facebook Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.CVE-2018-6845 · Other software · OLX Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.
- Product
- OLX Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 9, 2018Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field.CVE-2018-6878 · Other software · HOT Scripts Clone Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field.
- Product
- HOT Scripts Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 7, 2018PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.CVE-2018-6796 · Other software · Multilanguage Real Estate MLM Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.
- Product
- Multilanguage Real Estate MLM Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 7, 2018PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.CVE-2018-6795 · Other software · Naukri Clone Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 7, 2018PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.CVE-2018-6655 · Other software · Doctor Search Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.
- Product
- Doctor Search Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.CVE-2017-17988 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.CVE-2017-17987 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.CVE-2017-17986 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.