Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,672 results · page 41 of 54
Jul 8, 2022A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2022-31290 · Other software · Withknown · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.
- Product
- Known
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.withknown.comblog.jitendrapatro.me
Jul 4, 2022Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.CVE-2022-34829 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jun 24, 2022A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2022-33122 · Other software · Eyoucms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog moCVE-2022-33113 · Other software · Jflyfox · reported by MITREMedium 5.4
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload anCVE-2022-23171 · Other software · AtlasVPN · reported by cna@cyber.gov.ilMedium 5.9
AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.
- Product
- AtlasVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data).CVE-2022-31246 · Other software · Electrum · reported by MITREMedium 5.5
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
- Product
- Electrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.CVE-2022-31908 · Other software · Student Registration And FEE Payment System Project · reported by MITREHigh 7.2
Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
- Product
- Student Registration And FEE Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection.CVE-2019-4575 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 166801.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 13, 2022attacker needs to craft a SQL payload.CVE-2022-23169 · Other software · Amodat · reported by cna@cyber.gov.ilMedium 5.9
attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.
- Product
- Amodat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library.CVE-2022-29254 · Other software · silverstripe · reported by GitHubLow 3.7
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.
- Product
- silverstripe-omnipay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.CVE-2022-30512 · Other software · School Dormitory Management System Project · reported by MITRECritical 9.8
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
- Product
- School Dormitory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 2, 2022SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to acceCVE-2022-30496 · Other software · MV · reported by MITREHigh 7.5
SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to access enterprise's private and sensitive information.
- Product
- Idce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Jun 2, 2022A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2022-29734 · Other software · ICT · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
- Product
- Protege GX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like FuCVE-2022-30015 · Other software · Simple Food Website Project · reported by MITREMedium 5.4
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
- Product
- Simple Food Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 19, 2022A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to oCVE-2020-16209 · Other software · Fieldcomm Group · reported by ics-cert@hq.dhs.govCritical 9.8
A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.
- Product
- HART-IP Developer Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.CVE-2022-28956 · Other software · Dlink · reported by MITRECritical 9.8
An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.
- Product
- Dir-816l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.CVE-2022-30387 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.CVE-2022-30000 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1682 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.phpCVE-2022-29938 · Other software · Librehealth · reported by MITREHigh 8.8
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
- Product
- Librehealth EHR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- LifterLMS PayPal
- Fixed in
- 1.4.0
- What to do
- Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
Apr 28, 2022A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-28102 · Websites & servers · PHP Mysql Admin Panel Generator Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php.
- Product
- PHP Mysql Admin Panel Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.CVE-2022-29152 · Other software · Ericom · reported by MITREMedium 6.1
The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.
- Product
- Powerterm Webconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars.CVE-2022-28586 · Other software · Hoosk · reported by MITREMedium 6.1
XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars.
- Product
- Hoosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php.CVE-2022-28020 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php.CVE-2022-28019 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php.CVE-2022-28018 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php.CVE-2022-28017 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php.CVE-2022-28016 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php.CVE-2022-28015 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php.CVE-2022-28014 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.php.CVE-2022-28013 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php.CVE-2022-28012 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php.CVE-2022-28011 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php.CVE-2022-28010 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.CVE-2022-28009 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.CVE-2022-28008 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_delete.php.CVE-2022-28007 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php.CVE-2022-28006 · Other software · Attendance And Payroll System Project · reported by MITREHigh 8.8
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php.
- Product
- Attendance And Payroll System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Apr 20, 2022The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity CVE-2021-43990 · Other software · FANUC · reported by ics-cert@hq.dhs.govMedium 6.1
The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.
- Product
- ROBOGUIDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6: Cross-site request forgery (CSRF)CVE-2022-27629 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors.
- Product
- MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6
- Fixed in
- 1.9.6
- What to do
- Update MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 to 1.9.6 or newer.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Apr 19, 2022Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure).CVE-2022-21475 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Payments accessible data as well as unauthorized read access to a subset of Oracle Banking Payments accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Payments. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
- Product
- Banking Payments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.CVE-2022-27474 · Other software · Salesagility · reported by MITREHigh 7.2
SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.CVE-2022-27952 · Other software · Payloadcms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
- Product
- Payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2022-27961 · Other software · Ofcms Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-28468 · Other software · Payroll Management System Project · reported by MITRECritical 9.8
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- Product
- Payroll Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-0468 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Apr 4, 2022A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into thCVE-2022-27441 · Other software · Tpcms Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
- Product
- Tpcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.CVE-2022-26273 · Other software · Eyoucms · reported by MITRECritical 9.8
EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.CVE-2022-26255 · Other software · Clash Project · reported by MITRECritical 9.8
Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.
- Product
- Clash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.