Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 54 of 87
Jan 25, 2024A vulnerability, which was classified as problematic, has been found in Mafiatic Blue Server 1.1.CVE-2024-0887 · Other software · Mafiatic · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Mafiatic Blue Server 1.1. Affected by this issue is some unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252038 is the identifier assigned to this vulnerability.
- Product
- Blue Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A vulnerability classified as problematic was found in Poikosoft EZ CD Audio Converter 8.0.7.CVE-2024-0886 · Other software · Poikosoft · reported by VulDBLow 3.3
A vulnerability classified as problematic was found in Poikosoft EZ CD Audio Converter 8.0.7. Affected by this vulnerability is an unknown functionality of the component Activation Handler. The manipulation of the argument Key leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-252037 was assigned to this vulnerability.
- Product
- EZ CD Audio Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A vulnerability classified as problematic has been found in SpyCamLizard 1.230.CVE-2024-0885 · Other software · Spycamlizard · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252036.
- Product
- Spycamlizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 25, 2024A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic.CVE-2024-0880 · Other software · Qidianbang · reported by VulDBMedium 4.3
A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/edit?id=2 of the component Password Reset. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252032. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- qdbcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.CVE-2024-0783 · Other software · Project Worlds · reported by VulDBMedium 6.3
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects some unknown processing of the file documents.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251699.
- Product
- Online Admission System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic.CVE-2024-0782 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file pass-profile.php. The manipulation of the argument First Name/Last Name/User Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251698 is the identifier assigned to this vulnerability.
- Product
- Online Railway Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 22, 2024A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0.CVE-2024-0781 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client_signup.php. The manipulation of the argument Client Full Name with the input <meta http-equiv="refresh" content="0; url=https://vuldb.com" /> leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251697 was assigned to this vulnerability.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 22, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930.CVE-2024-0778 · Other software · Uniview · reported by VulDBHigh 8
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue is the function setNatConfig of the file /Interface/DevManage/VM.php. The manipulation of the argument natAddress/natPort/natServerPort leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251696. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- ISC 2500-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2024A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0.CVE-2024-0776 · Other software · LinZhaoguan · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation with the input <div onmouseenter="alert("xss)"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251678 is the identifier assigned to this vulnerability.
- Product
- pb-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2024A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0.CVE-2024-0773 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the file pages_client_signup.php. The manipulation of the argument Client Full Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251677 was assigned to this vulnerability.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 21, 2024A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic.CVE-2024-0772 · Other software · Nsasoft · reported by VulDBMedium 5.3
A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ShareAlarmPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2024A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic.CVE-2024-0771 · Other software · Nsasoft · reported by VulDBMedium 5.3
A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Product Key Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2024A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows.CVE-2024-0770 · Other software · European Chemicals Agency · reported by VulDBMedium 4.4
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- IUCLID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2024A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a.CVE-2016-15037 · Other software · go4rayyan · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a. Affected by this issue is some unknown functionality of the component Task Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.2 is able to address this issue. The patch is identified as 5c9120f2362ddb7cbe48f2c4620715adddc4ee35. It is recommended to upgrade the affected component. VDB-251570 is the identifier assigned to this vulnerability.
- Product
- Scumblr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20.CVE-2024-0739 · Other software · Hecheng · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. The manipulation of the argument install leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251562 is the identifier assigned to this vulnerability.
- Product
- Leadshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 19, 2024A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0.CVE-2024-0738 · Other software · 个人开源 · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0. This issue affects the function ExpressionEngine of the file com/mldong/modules/wf/engine/model/DecisionModel.java. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251561 was assigned to this vulnerability.
- Product
- mldong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1.CVE-2024-0737 · Other software · Xlightftpd · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251560.
- Product
- Xlight FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 19, 2024A vulnerability classified as problematic has been found in EFS Easy File Sharing FTP 3.6.CVE-2024-0736 · Other software · EFS · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in EFS Easy File Sharing FTP 3.6. This affects an unknown part of the component Login. The manipulation of the argument password leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251559.
- Product
- Easy File Sharing FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic.CVE-2024-0732 · Other software · PCMan · reported by VulDBMedium 5.3
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251555.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic.CVE-2024-0731 · Other software · PCMan · reported by VulDBMedium 5.3
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251554 is the identifier assigned to this vulnerability.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0.CVE-2024-0730 · Other software · Project Worlds · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course_ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251553 was assigned to this vulnerability.
- Product
- Online Time Table Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtorada.notion.sitevuldb.com
Jan 19, 2024A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23.CVE-2024-0729 · Other software · ForU · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. Affected by this issue is some unknown functionality of the file cms_admin.php. The manipulation of the argument a_name leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251552.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23.CVE-2024-0728 · Other software · ForU · reported by VulDBMedium 4.7
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251551.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic.CVE-2024-0721 · Other software · Jspxcms · reported by VulDBLow 3.5
A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Survey Label Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251545 was assigned to this vulnerability.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9.CVE-2024-0720 · Other software · FactoMineR · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML Report Generator. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251544. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FactoInvestigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 19, 2024A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7.CVE-2024-0718 · Other software · liuwy-dlsdys · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7. This issue affects some unknown processing of the file /oa/notify/edit of the component HTTP POST Request Handler. The manipulation of the argument notifyTitle leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251543.
- Product
- zhglxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-CVE-2024-0717 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability.
- Product
- DAP-1360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15.CVE-2024-0716 · Other software · Byzoro · reported by VulDBLow 3.1
A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S150 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4.CVE-2024-0696 · Other software · AtroCore · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4. This affects an unknown part of the file /#ProductSerie/view/ of the component Product Series Overview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251481 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AtroPIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpasteboard.covuldb.com
Jan 18, 2024A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1.CVE-2024-0695 · Other software · EFS · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the component HTTP GET Request Handler. The manipulation of the argument USERNAME leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251480. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 18, 2024A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0.CVE-2024-0693 · Other software · EFS · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251479. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy File Sharing FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day.todaypacketstormsecurity.com
Jan 17, 2024A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical.CVE-2024-0655 · Other software · Xxyopen · reported by VulDBMedium 5.5
A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251383.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22.CVE-2024-0654 · Other software · Iperov · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the file mainscripts/Util.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-251382 is the identifier assigned to this vulnerability.
- Product
- Deepfacelab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical.CVE-2024-0649 · Other software · Zhiyun-tech · reported by VulDBMedium 6.3
A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375.
- Product
- Zhihuiyun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 17, 2024A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical.CVE-2024-0648 · Other software · Yunyou · reported by VulDBHigh 7.3
A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/Common.php. The manipulation of the argument templateFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251374 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 17, 2024A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2.CVE-2024-0647 · Other software · Sparksuite · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251373 was assigned to this vulnerability.
- Product
- SimpleMDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability classified as critical has been found in ZhiCms up to 4.0.CVE-2024-0603 · Other software · Zhicms · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250839.
- Product
- Zhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 16, 2024A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452.CVE-2024-0579 · Other software · Totolink · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452. Affected by this vulnerability is the function formMapDelDevice of the file /boafrm/formMapDelDevice. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X2000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0578 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical.CVE-2024-0574 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this issue is the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument sTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250790 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability has been found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical.CVE-2024-0573 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability has been found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250789 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0572 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0571 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. This issue affects the function setSmsCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument text leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265.CVE-2024-0570 · Other software · Totolink · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. It is recommended to upgrade the affected component. VDB-250786 is the identifier assigned to this vulnerability.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905.CVE-2024-0569 · Other software · Totolink · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.5cu.862_B20230228 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-250785 was assigned to this vulnerability.
- Product
- T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 16, 2024A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2.CVE-2011-10005 · Other software · Easyftp Server Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250716.
- Product
- Easyftp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024A vulnerability has been found in DedeBIZ 6.3.0 and classified as critical.CVE-2024-0558 · Other software · Dedebiz · reported by VulDBMedium 4.7
A vulnerability has been found in DedeBIZ 6.3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/makehtml_freelist_action.php. The manipulation of the argument startid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250726 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0.CVE-2024-0557 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250725 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic.CVE-2024-0548 · Other software · FreeFloat · reported by VulDBMedium 5.3
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component SIZE Command Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250718 is the identifier assigned to this vulnerability.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 15, 2024A vulnerability has been found in Ability FTP Server 2.34 and classified as problematic.CVE-2024-0547 · Other software · Codecrafters · reported by VulDBMedium 5.3
A vulnerability has been found in Ability FTP Server 2.34 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component APPE Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250717 was assigned to this vulnerability.
- Product
- Ability FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.