Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 44 of 87
Jul 21, 2024A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10.CVE-2024-6964 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Affected is the function fromDhcpSetSer. The manipulation of the argument dhcpEn/startIP/endIP/preDNS/altDNS/mask/gateway leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272118 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- O3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10.CVE-2024-6963 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272117 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- O3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability classified as critical was found in Tenda O3 1.0.0.10.CVE-2024-6962 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. This vulnerability affects the function formQosSet. The manipulation of the argument remark/ipRange/upSpeed/downSpeed/enable leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272116. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- O3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0.CVE-2024-6950 · Other software · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?import of the component HTTP POST Request Handler. The manipulation of the argument file leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272072.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 21, 2024A vulnerability classified as problematic was found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120.CVE-2024-6949 · Other software · Gargaj · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected by this vulnerability is an unknown functionality of the file /pages.php?edit=News. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-272071.
- Product
- wuhu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120.CVE-2024-6948 · Other software · Gargaj · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the file /slideeditor.php of the component Slide Editor. The manipulation of the argument newSlideFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272070 is the identifier assigned to this vulnerability.
- Product
- wuhu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.CVE-2024-6944 · Other software · ZhongBangKeJi · reported by VulDBMedium 5.3
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 21, 2024A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.CVE-2024-6943 · Other software · ZhongBangKeJi · reported by VulDBMedium 5.3
A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 21, 2024A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0.CVE-2024-6942 · Other software · Thinksaas · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272064.
- Product
- Thinksaas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0.CVE-2024-6941 · Other software · thinksaas · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/action/do.php. The manipulation of the argument site_title/site_subtitle/site_key/site_desc/site_url/site_email/site_icp leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272063.
- Product
- thinksaas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic.CVE-2024-6939 · Other software · Xinhu · reported by VulDBMedium 5.3
A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271994 is the identifier assigned to this vulnerability.
- Product
- RockOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability has been found in SiYuan 3.1.0 and classified as problematic.CVE-2024-6938 · Other software · b3log · reported by VulDBMedium 5.3
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of the component PDF Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271993 was assigned to this vulnerability.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1.CVE-2024-6937 · Other software · formtools.org · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Form Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1.CVE-2024-6936 · Other software · formtools.org · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the argument Page Theme leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271991. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Form Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1.CVE-2024-6935 · Other software · formtools.org · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-271990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Form Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1.CVE-2024-6934 · Other software · formtools.org · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271989 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Form Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows.CVE-2024-6746 · Other software · NaiboWang · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue "because the default is that the software runs locally without going through the Internet".
- Product
- EasySpider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04.CVE-2024-6681 · Other software · witmy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown functionality of the file /api/dept. The manipulation of the argument params.dataScope leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271154 is the identifier assigned to this vulnerability.
- Product
- my-springsecurity-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04.CVE-2024-6680 · Other software · witmy · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271153 was assigned to this vulnerability.
- Product
- my-springsecurity-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04.CVE-2024-6679 · Other software · witmy · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271152.
- Product
- my-springsecurity-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical.CVE-2024-6676 · Other software · witmy · reported by VulDBMedium 5.3
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271111.
- Product
- my-springsecurity-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38.CVE-2016-15039 · Other software · mhuertos · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
- Product
- phpLDAPadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7.CVE-2024-6647 · Other software · croogo · reported by VulDBMedium 5.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Advanced Classifieds & Directory Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37501 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 7, 2024A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28.CVE-2024-6539 · Other software · heyewei · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270450 is the identifier assigned to this vulnerability.
- Product
- SpringBootCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03.CVE-2024-6526 · Websites & servers · CodeIgniter · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability.
- Product
- Ecommerce-CodeIgniter-Bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2024A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9.CVE-2024-6511 · Other software · y_project · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.
- Product
- RuoYi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0.CVE-2024-6452 · Other software · linlinjava · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270235.
- Product
- litemall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024A vulnerability has been found in Hitout Carsale 1.0 and classified as critical.CVE-2024-6438 · Other software · Hitout · reported by VulDBMedium 5.3
A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability.
- Product
- Carsale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-5545 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
- Product
- Motors – Car Dealer, Classifieds & Listing
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 30, 2024A vulnerability classified as problematic was found in Ingenico Estate Manager 2023.CVE-2024-6415 · Other software · Ingenico · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREF_HOME_PAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Estate Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 29, 2024A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x.CVE-2024-6414 · Other software · Parsec Automation · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TrakSYS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12.CVE-2024-6403 · Network & remote access · Tenda · reported by VulDBHigh 7.1
A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269948. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A301
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024A vulnerability classified as critical was found in Tenda A301 15.13.08.12.CVE-2024-6402 · Network & remote access · Tenda · reported by VulDBHigh 7.1
A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269947. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A301
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic.CVE-2024-6374 · Other software · lahirudanushka · reported by VulDBMedium 5.3
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecretive-agate-23c.notion.sitesecretive-agate-23c.notion.site
Jun 27, 2024A vulnerability classified as problematic was found in LabVantage LIMS 2017.CVE-2024-6370 · Other software · LabVantage · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argument bulletinbody leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269803.
- Product
- LIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 27, 2024A vulnerability classified as problematic has been found in LabVantage LIMS 2017.CVE-2024-6369 · Other software · LabVantage · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LV_ReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269802 is the identifier assigned to this vulnerability.
- Product
- LIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 27, 2024Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through ManiCVE-2024-0947 · Other software · Talya Informatics · reported by iletisim@usom.gov.trCritical 9.8
Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb: before v17.0.68.
- Product
- Elektraweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 26, 2024A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0.CVE-2024-6344 · Other software · ZKTeco · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- ZKBio CVSecurity V5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2024A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical.CVE-2024-6279 · Other software · lahirudanushka · reported by VulDBMedium 5.3
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file examresults-par.php of the component Exam Results Page. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269492.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical.CVE-2024-6278 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file subject.php of the component Subject Page. The manipulation of the argument update leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269491.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6277 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the file student.php of the component Student Page. The manipulation of the argument update leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269490 is the identifier assigned to this vulnerability.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6276 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown processing of the file teacher.php of the component Teacher Page. The manipulation of the argument update leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269489 was assigned to this vulnerability.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6275 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file parent.php of the component Parent Page. The manipulation of the argument update leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269488.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6274 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attendancelist.php of the component Attendance Report Page. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269487.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
Jun 23, 2024A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical.CVE-2024-6269 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/vpn/autovpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument indevice leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269482 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2024A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6268 · Other software · lahirudanushka · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknown functionality of the file login.php of the component Login Page. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269480.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compowerful-bulb-c36.notion.site
Jun 22, 2024A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2.CVE-2024-6266 · Other software · pearadmin · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269478 is the identifier assigned to this vulnerability.
- Product
- pear_admin_boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2024A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic.CVE-2024-6252 · Other software · Zorlan · reported by VulDBMedium 5.1
A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Task Handler. The manipulation of the argument onerror leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269419.
- Product
- SkyCaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comvuldb.com
Jun 22, 2024A vulnerability, which was classified as problematic, was found in playSMS 1.4.3.CVE-2024-6251 · Other software · playsms · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the argument name/email leads to basic cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- playsms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.