Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 41 of 73
Sep 2, 2021An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.CVE-2020-18048 · Other software · Bertanddip · reported by MITRECritical 9.8
An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
- Product
- Craigms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Sep 1, 2021WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.CVE-2020-20349 · Other software · Wtcms Project · reported by MITREMedium 5.4
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.
- Product
- Wtcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.CVE-2020-20348 · Other software · Wtcms Project · reported by MITREMedium 5.4
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.
- Product
- Wtcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.CVE-2020-20347 · Other software · Wtcms Project · reported by MITREMedium 5.4
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.
- Product
- Wtcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' fieldCVE-2021-36020 · Websites & servers · Adobe · reported by AdobeHigh 8.2
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Aug 31, 2021Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New ForuCVE-2020-19049 · Other software · Mybb · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" pagCVE-2020-19048 · Other software · Mybb · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
- Product
- Mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled.CVE-2021-34560 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.5
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 30, 2021A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.CVE-2021-27557 · Other software · Easycorp · reported by MITREMedium 4.3
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivasec.comprivasec.com
Aug 30, 2021The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript vCVE-2021-39117 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Aug 27, 2021Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpoCVE-2020-19002 · Other software · Jupo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.CVE-2020-18477 · Other software · Hucart · reported by MITREHigh 8.8
SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.
- Product
- Hucart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.CVE-2020-18476 · Other software · Hucart · reported by MITREHigh 8.8
SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.
- Product
- Hucart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field.CVE-2020-18475 · Other software · Hucart · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed.
- Product
- Hucart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote attaCVE-2020-18470 · Other software · Rukovoditel · reported by MITREMedium 5.4
Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to rukovoditel_2.4.1/install/index.php.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 alloCVE-2020-18469 · Other software · Rukovoditel · reported by MITREMedium 5.4
Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to /rukovoditel_2.4.1/index.php?module=configuration/save&redirect_to=configuration/application.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name CVE-2020-18468 · Other software · Qdpm · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.
- Product
- Qdpm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website naCVE-2020-18467 · Other software · Bigtreecms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffCVE-2021-3712 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.4
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_S
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcert-portal.siemens.com
Aug 23, 2021KN Fix Your Title: Was vulnerable to Authenticated Stored XSS in the separator fieldCVE-2021-24547 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.
- Product
- KN Fix Your Title
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update KN Fix Your Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021Grid Gallery – Photo Image Grid Gallery: Does not properly sanitize the title field for image galleriesCVE-2021-24529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.
- Product
- Grid Gallery – Photo Image Grid Gallery
- Fixed in
- 1.2.5
- What to do
- Update Grid Gallery – Photo Image Grid Gallery to 1.2.5 or newer.
Aug 20, 2021Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.CVE-2020-18885 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 18, 2021Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.CVE-2020-28146 · Other software · Eyoucms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 17, 2021An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.CVE-2020-13589 · Other software · Rukovoditel · reported by talos-cna@cisco.comHigh 8.8
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in the 'entities/fields page (mulitple_edit or copy_selected or export function) is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 17, 2021An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.CVE-2020-13588 · Other software · Rukovoditel · reported by talos-cna@cisco.comHigh 8.8
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The heading_field_id parameter in ‘‘entities/fields’ page is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 16, 2021Mimetic Books: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings pageCVE-2021-24548 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
- Product
- Mimetic Books
- Affected
- up to 0.2.13
- What to do
- Affects up to 0.2.13. Update Mimetic Books to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021VikRentCar Car Rental Management System: Does not sanitise the 'Text Next to Icon' fieldCVE-2021-24519 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.10
- What to do
- Update VikRentCar Car Rental Management System to 1.1.10 or newer.
Aug 16, 2021My Site Audit: Does not sanitise or escape the Audit Name fieldCVE-2021-24445 · WordPress plugins & themes · reported by WPScanMedium 5.5
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- My Site Audit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update My Site Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2021PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.CVE-2021-38603 · Other software · Pluxml · reported by MITREMedium 4.8
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 12, 2021Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-28121 · WordPress plugins & themes · reported by MITRECritical 9.8
Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
- Fixed in
- 1.10
- What to do
- Update the plugin to 1.10 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2021Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.CVE-2021-35955 · Other software · Contao · reported by MITREMedium 4.8
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
- Product
- Contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HCVE-2020-21930 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts oCVE-2020-21929 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021Forms: Did not sanitise its input fieldsCVE-2021-24505 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
- Product
- Forms
- Fixed in
- 1.12.3
- What to do
- Update Forms to 1.12.3 or newer.
Aug 6, 2021Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the compCVE-2020-18693 · Other software · Mineweb · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'.
- Product
- Minewebcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0].CVE-2021-36801 · Other software · Akaunting · reported by cve@rapid7.comHigh 8.1
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.
- Product
- Akaunting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol.CVE-2021-38111 · Other software · Defcon · reported by MITREHigh 8.8
The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol.
- Product
- DEF CON 27 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability.CVE-2021-36703 · Other software · Htmly · reported by MITREMedium 6.1
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabilityCVE-2021-36702 · Other software · Htmly · reported by MITREMedium 6.1
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
- Product
- WP LMS – Best WordPress LMS
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.9.2
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Aug 2, 2021TaxoPress – Create and Manage Taxonomies, Tags, Categories: Does not sanitise its Taxonomy description fieldCVE-2021-24444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- TaxoPress – Create and Manage Taxonomies, Tags, Categories
- Fixed in
- 3.0.7.2
- What to do
- Update TaxoPress – Create and Manage Taxonomies, Tags, Categories to 3.0.7.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Jul 30, 2021eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.CVE-2020-15948 · Other software · Egain · reported by MITREMedium 6.1
eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.
- Product
- Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 26, 2021Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.CVE-2020-23240 · Other software · Cmsmadesimple · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgdev.cmsmadesimple.org
Jul 26, 2021Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.CVE-2020-23239 · Other software · Textpattern · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021In the project create screen it's possible to inject malicious JS code to the certain fields.CVE-2021-21442 · Other software · OTRS AG · reported by security@otrs.comMedium 4.5
In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19.
- Product
- Time Accounting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field.CVE-2021-37470 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
- Product
- Webdictate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).CVE-2021-37459 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).CVE-2021-37458 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.