Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 55 of 87
Jan 15, 2024A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0.CVE-2024-0546 · Other software · Easyftp · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250715.
- Product
- Easyftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 15, 2024A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3.CVE-2024-0545 · Other software · CodeCanyon · reported by VulDBMedium 6.9
A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3. This vulnerability affects unknown code of the file /index.php/signin. The manipulation of the argument redirect with the input http://evil.com leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- RISE Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0.CVE-2024-0543 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of the file propertydetail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250713 was assigned to this vulnerability.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 15, 2024A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical.CVE-2024-0539 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical.CVE-2024-0538 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical. This vulnerability affects the function formQosManage_auto of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456).CVE-2024-0537 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456). This affects the function setWrlBasicInfo of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250707. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456).CVE-2024-0536 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456). Affected by this issue is the function setWrlAccessList of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250706 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- W9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability classified as critical was found in Tenda PA6 1.0.1.21.CVE-2024-0535 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability classified as critical was found in Tenda PA6 1.0.1.21. Affected by this vulnerability is the function cgiPortMapAdd of the file /portmap of the component httpd. The manipulation of the argument groupName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250705 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PA6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability classified as critical has been found in Tenda A15 15.13.07.13.CVE-2024-0534 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability classified as critical has been found in Tenda A15 15.13.07.13. Affected is an unknown function of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250704. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2024A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical.CVE-2024-0530 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reg_go.php of the component HTTP POST Request Handler. The manipulation of the argument username_reg leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical.CVE-2024-0529 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /apps/login_auth.php of the component HTTP POST Request Handler. The manipulation of the argument username_login leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250699. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0.CVE-2024-0528 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0. Affected is an unknown function of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250698 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Post-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability, which was classified as critical, has been found in CXBSoft Url-shorting up to 1.3.1.CVE-2024-0527 · Other software · CXBSoft · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in CXBSoft Url-shorting up to 1.3.1. This issue affects some unknown processing of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250697 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Url-shorting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability classified as critical was found in CXBSoft Url-shorting up to 1.3.1.CVE-2024-0526 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in CXBSoft Url-shorting up to 1.3.1. This vulnerability affects unknown code of the file /pages/short_to_long.php of the component HTTP POST Request Handler. The manipulation of the argument shorturl leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Url-shorting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 14, 2024A vulnerability classified as critical has been found in CXBSoft Url-shorting up to 1.3.1.CVE-2024-0525 · Other software · CXBSoft · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in CXBSoft Url-shorting up to 1.3.1. This affects an unknown part of the file /pages/long_s_short.php of the component HTTP POST Request Handler. The manipulation of the argument longurl leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Url-shorting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 13, 2024A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1.CVE-2024-0510 · Other software · HaoKeKeJi · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.
- Product
- YiQiNiu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 13, 2024A vulnerability was found in ZhongFuCheng3y Austin 1.0 and classified as critical.CVE-2024-0505 · Other software · ZhongFuCheng3y · reported by VulDBMedium 5.5
A vulnerability was found in ZhongFuCheng3y Austin 1.0 and classified as critical. This issue affects the function getFile of the file com/java3y/austin/web/controller/MaterialController.java of the component Upload Material Menu. The manipulation leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250619.
- Product
- Austin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2024A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1.CVE-2024-0491 · Other software · Huaxia · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. Upgrading to version 3.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250596.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2024A vulnerability classified as critical was found in Taokeyun up to 1.0.5.CVE-2024-0483 · Other software · Jifeer · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Taokeyun up to 1.0.5. This vulnerability affects the function index of the file application/index/controller/app/Task.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250588.
- Product
- Taokeyun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 13, 2024A vulnerability classified as critical has been found in Taokeyun up to 1.0.5.CVE-2024-0482 · Other software · Jifeer · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Taokeyun up to 1.0.5. This affects the function index of the file application/index/controller/app/Video.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250587.
- Product
- Taokeyun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 13, 2024A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0.CVE-2024-0476 · Websites & servers · Phpgurukul · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0. This affects an unknown part of the file request-received-bydonar.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250581 was assigned to this vulnerability.
- Product
- Blood Bank & Donor Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 12, 2024A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic.CVE-2022-4962 · Other software · apolloconfig · reported by VulDBMedium 4.3
A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04.CVE-2010-10011 · Other software · Acritum · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04. Affected is an unknown function. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250446 is the identifier assigned to this vulnerability.
- Product
- Femitter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical.CVE-2024-0459 · Websites & servers · Phpgurukul · reported by VulDBMedium 4.7
A vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250564.
- Product
- Blood Bank & Donor Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 11, 2024A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0.CVE-2022-4960 · Other software · cloudfavorites · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250238 is the identifier assigned to this vulnerability.
- Product
- favorites-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23.CVE-2024-0426 · Other software · ForU · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical.CVE-2023-7226 · Other software · meetyoucrop · reported by VulDBMedium 6.3
A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232.
- Product
- big-whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0.CVE-2022-4959 · Other software · qkmc-rk · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250237 was assigned to this vulnerability.
- Product
- redbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as critical was found in ForU CMS up to 2020-06-23.CVE-2024-0425 · Other software · ForU · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0.CVE-2024-0424 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250443.
- Product
- Simple Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 11, 2024A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic.CVE-2024-0419 · Other software · Jasper · reported by VulDBMedium 5.3
A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250439.
- Product
- httpdx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvuldb.com
Jan 11, 2024A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic.CVE-2024-0418 · Other software · iSharer and upRedSun · reported by VulDBMedium 5.3
A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability.
- Product
- File Sharing Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvuldb.com
Jan 11, 2024A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5.CVE-2024-0417 · Other software · DeShang · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.
- Product
- DSShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 11, 2024A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3.CVE-2024-0416 · Other software · DeShang · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.
- Product
- DSMall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 11, 2024A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0.CVE-2024-0415 · Other software · DeShang · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435.
- Product
- DSMall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 11, 2024A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1.CVE-2024-0414 · Other software · DeShang · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.
- Product
- DSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 11, 2024A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0.CVE-2022-4958 · Other software · qkmc-rk · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation of the argument title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250236.
- Product
- redbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical.CVE-2024-0357 · Other software · coderd-repos · reported by VulDBMedium 5.5
A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250124.
- Product
- Eva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic.CVE-2024-0356 · Other software · Mandelo · reported by VulDBMedium 4.3
A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250123.
- Product
- ssm_shiro_blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8.CVE-2024-0354 · Other software · unknown-o · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.
- Product
- download-station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2024A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.CVE-2024-0352 · Other software · Likeshop · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.
- Product
- Likeshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2024A vulnerability has been found in CodeAstro Vehicle Booking System 1.0 and classified as problematic.CVE-2024-0346 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability has been found in CodeAstro Vehicle Booking System 1.0 and classified as problematic. This vulnerability affects unknown code of the file usr/user-give-feedback.php of the component Feedback Page. The manipulation of the argument My Testemonial leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250114 is the identifier assigned to this vulnerability.
- Product
- Vehicle Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 9, 2024A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0.CVE-2024-0345 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Address with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250113 was assigned to this vulnerability.
- Product
- Vehicle Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 9, 2024A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1.CVE-2024-0344 · Other software · soxft · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250112.
- Product
- TimeMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2024A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6.CVE-2024-0343 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250111.
- Product
- Simple House Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 9, 2024A vulnerability classified as critical has been found in Inis up to 2.0.1.CVE-2024-0342 · Other software · Inis Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250110 is the identifier assigned to this vulnerability.
- Product
- Inis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2024A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923.CVE-2023-7223 · Other software · Totolink · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 9, 2024A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical.CVE-2023-7220 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical.CVE-2023-7219 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012.CVE-2023-7218 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.