Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
340 results · page 5 of 7
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.CVE-2017-17985 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.CVE-2017-17984 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.CVE-2017-17983 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.CVE-2017-17982 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 6.8
PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.CVE-2017-17981 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.CVE-2017-17960 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREHigh 8.8
PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.CVE-2017-17959 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITRECritical 9.8
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.CVE-2017-17958 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.CVE-2017-17957 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITRECritical 9.8
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.CVE-2017-17956 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.CVE-2017-17955 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.CVE-2017-17954 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.CVE-2017-17953 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREMedium 6.1
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed CVE-2017-17952 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITREHigh 8.6
PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.CVE-2017-17951 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITRECritical 9.8
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.
- Product
- PHP Multivendor Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-17941 · Other software · Single Theater Booking Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.
- Product
- Single Theater Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-17940 · Other software · Single Theater Booking Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
- Product
- Single Theater Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.CVE-2017-17939 · Other software · Single Theater Booking Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
- Product
- Single Theater Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2017PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.CVE-2017-17938 · Other software · Single Theater Booking Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
- Product
- Single Theater Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.CVE-2017-17931 · Other software · Resume Clone Script Project · reported by MITRECritical 9.8
PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
- Product
- Resume Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.CVE-2017-17930 · Other software · Ordermanagementscript · reported by MITREHigh 8.8
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.CVE-2017-17929 · Other software · Ordermanagementscript · reported by MITREMedium 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.CVE-2017-17928 · Other software · Ordermanagementscript · reported by MITRECritical 9.8
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/CVE-2017-17927 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofeCVE-2017-17926 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.CVE-2017-17925 · Other software · Ordermanagementscript · reported by MITREMedium 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.phpCVE-2017-17924 · Other software · Ordermanagementscript · reported by MITREMedium 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
- Product
- Professional Service Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.CVE-2017-17909 · Other software · Responsive Realestate Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
- Product
- Responsive Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.CVE-2017-17908 · Other software · Responsive Realestate Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
- Product
- Responsive Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.CVE-2017-17907 · Other software · CAR Rental Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.CVE-2017-17906 · Other software · CAR Rental Script Project · reported by MITRECritical 9.8
PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.CVE-2017-17905 · Other software · CAR Rental Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.CVE-2017-17594 · Other software · Domainsale PHP Script Project · reported by MITRECritical 9.8
DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
- Product
- Domainsale PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), which might allow remoCVE-2017-17568 · Other software · Scubez · reported by MITREHigh 7.5
Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), which might allow remote attackers to obtain sensitive information via a direct request.
- Product
- Posty Readymade Classifieds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2017AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.CVE-2017-15978 · Other software · Arox · reported by MITRECritical 9.8
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
- Product
- School ERP PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Aug 25, 2017The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remoCVE-2014-7860 · Network & remote access · D-link · reported by MITREMedium 5.3
The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.
- Product
- Dns-327l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 17, 2017Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious imaCVE-2017-11347 · Other software · Metinfo · reported by MITREHigh 8.8
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2017BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/pCVE-2017-9444 · Other software · Bigtreecms · reported by MITREHigh 8.8
BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
- Product
- Bigtree CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2016Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.CVE-2015-8279 · Computers, phones & browsers · Samsung · reported by cret@cert.orgHigh 8.6
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
- Product
- Web Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 20, 2015Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.12CVE-2015-6548 · Other software · Symantec · reported by secure@symantec.comMedium 5.8
Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- Product
- Web Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 20, 2015Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2CVE-2015-5691 · Other software · Symantec · reported by secure@symantec.comMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against admin_messages.php.
- Product
- Web Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Sep 20, 2015Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenCVE-2014-9229 · Other software · Symantec · reported by secure@symantec.comMedium 6.5
Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
- Product
- Endpoint Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 25, 2015Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.CVE-2015-0935 · Other software · Bomgar · reported by cret@cert.orgHigh 7.5
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
- Product
- Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Dec 29, 2014The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allowCVE-2011-2727 · Other software · Tribiq · reported by Red HatMedium 4.3
The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
- Product
- Tribiq CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Nov 17, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administraCVE-2014-8953 · Websites & servers · Phpscriptlerim · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to hijack the authentication of administrators or requests that (1) add an admin account via a request to filepath/yonetim/plugin/adminsave.php or have unspecified impact via a request to (2) ayarsave.php, (3) uyesave.php, (4) slaytadd.php, or (5) slaytsave.php.
- Product
- PHP Scriptlerim Who's WHO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 20, 2014Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files CVE-2014-3340 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCuo16166.
- Product
- Webex Meetmenow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comsecurityfocus.com
Jul 3, 2014The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.CVE-2014-4672 · Other software · Yiiframework · reported by MITREHigh 7.5
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Apr 1, 2014The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execCVE-2014-1691 · Other software · Horde · reported by MITREHigh 7.5
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Product
- Horde Application Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 19, 2013The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldataCVE-2013-6129 · Other software · Vbulletin · reported by MITREHigh 7.5
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnet-security.orgvbulletin.com
Sep 23, 2013SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingiCVE-2013-5931 · Other software · Real-estate-php-script · reported by MITREHigh 7.5
SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
- Product
- Real Estate PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.