Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
224 results · page 5 of 5
Feb 11, 2019DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.CVE-2019-7747 · Other software · Dbninja · reported by MITRECritical 9.6
DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.
- Product
- Dbninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.CVE-2019-7545 · Other software · Dbninja · reported by MITREMedium 5.4
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.
- Product
- Dbninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.pCVE-2018-19796 · WordPress plugins & themes · reported by MITREMedium 6.1
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
- Product
- An open redirect in the Ninja Forms
- Fixed in
- 3.3.19.1
- What to do
- Update An open redirect in the Ninja Forms to 3.3.19.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 15, 2018XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submisCVE-2018-19287 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
- Product
- XSS in the Ninja Forms
- Fixed in
- 3.3.18
- What to do
- Update XSS in the Ninja Forms to 3.3.18 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 1, 2018The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.CVE-2018-16308 · WordPress plugins & themes · reported by MITREHigh 8.6
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
- Product
- Ninja Forms
- Fixed in
- 3.3.14.1
- What to do
- Update Ninja Forms to 3.3.14.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Feb 21, 2018The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-7280 · WordPress plugins & themes · reported by MITREMedium 6.1
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- Product
- Ninja Forms
- Fixed in
- 3.2.14
- What to do
- Update Ninja Forms to 3.2.14 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 2, 2018Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of servCVE-2017-1000466 · Other software · Invoiceninja · reported by MITREMedium 5.4
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.
- Product
- Invoice Ninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
- Product
- Ninja Forms
- Fixed in
- 2.9.42.1
- What to do
- Update Ninja Forms to 2.9.42.1 or newer.
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scriCVE-2015-2220 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms
- Fixed in
- 2.8.9
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms to 2.8.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
- Product
- Unspecified vulnerability in the Ninja Forms
- Fixed in
- 2.8.10
- What to do
- Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Oct 21, 2014The Awful Ninja Game (aka com.absolutelyawfulapplications.awfulninjagame) application 1.0.23 for Android does not verify X.509 certificates from SSL servers, whCVE-2014-7757 · Other software · Awful Ninja Game Project · reported by cret@cert.orgMedium 5.4
The Awful Ninja Game (aka com.absolutelyawfulapplications.awfulninjagame) application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Awful Ninja Game
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 9, 2014The Ninja Chicken Ooga Booga (aka mominis.Generic_Android.Ninja_Chicken_Ooga_Booga) application 1.4.2 for Android does not verify X.509 certificates from SSL seCVE-2014-5789 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken Ooga Booga (aka mominis.Generic_Android.Ninja_Chicken_Ooga_Booga) application 1.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Ninja Chicken Ooga Booga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 9, 2014The Ninja Chicken Adventure Island (aka mominis.Generic_Android.Ninja_Chicken_Adventure_Island) application 1.1.1 for Android does not verify X.509 certificatesCVE-2014-5788 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken Adventure Island (aka mominis.Generic_Android.Ninja_Chicken_Adventure_Island) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Ninja Chicken Adventure Island
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 9, 2014The Ninja Chicken (aka mominis.Generic_Android.Ninja_Chicken) application 1.7.6 for Android does not verify X.509 certificates from SSL servers, which allows maCVE-2014-5787 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken (aka mominis.Generic_Android.Ninja_Chicken) application 1.7.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Ninja Chicken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 8, 2014The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows mCVE-2014-5670 · Other software · Ninjakiwi · reported by cret@cert.orgMedium 5.4
The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Sas\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jun 10, 2014the Conversion Ninja plugin for: Cross-site scripting (XSS)CVE-2014-4017 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Conversion Ninja plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php.
- Product
- the Conversion Ninja plugin for
- What to do
- Update the Conversion Ninja plugin for to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 23, 2013Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.CVE-2012-6503 · Other software · Ninjaforge · reported by MITREHigh 10
Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.
- Product
- COM Ninjaxplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordninjaforge.comsecunia.com
Nov 1, 2011SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the ItemiCVE-2010-4991 · Other software · Ninjaforge · reported by MITREHigh 7.5
SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a display action to index.php.
- Product
- Ninjamonials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Nov 18, 2009SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via theCVE-2009-3964 · Other software · Ninjaforge · reported by MITREHigh 7.5
SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php.
- Product
- COM Ninjamonials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Apr 29, 2009Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a ..CVE-2009-1486 · Other software · Ninjadesigns · reported by MITREHigh 7.5
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.
- Product
- Flatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Feb 13, 2009admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers tCVE-2009-0571 · Other software · Ninjadesigns · reported by MITREMedium 5
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the backup directory.
- Product
- Mailist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Feb 13, 2009Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attCVE-2009-0570 · Other software · Ninjadesigns · reported by MITREMedium 5.1
Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter. NOTE: some of these details are obtained from third party information.
- Product
- Mailist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Jan 29, 2009Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files viaCVE-2009-0325 · Other software · Ninjadesigns · reported by MITREMedium 4.3
Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the cat parameter.
- Product
- Ninja Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.compush55.co.uk
Sep 30, 2005The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a syCVE-2005-3111 · Other software · Debian · reported by MITRELow 2.1
The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.
- Product
- Backupninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.