Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 56 of 87
Jan 9, 2024A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923.CVE-2023-7223 · Other software · Totolink · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 9, 2024A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical.CVE-2023-7220 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical.CVE-2023-7219 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012.CVE-2023-7218 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic.CVE-2024-0305 · Other software · Guangzhou Yingke Electronic Technology · reported by VulDBMedium 5.3
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.
- Product
- Ncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical.CVE-2024-0304 · Other software · Youke365 · reported by VulDBMedium 6.3
A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.
- Product
- Youke 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 8, 2024A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3.CVE-2024-0303 · Other software · Youke365 · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249870 is the identifier assigned to this vulnerability.
- Product
- Youke 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 8, 2024A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE.CVE-2024-0302 · Other software · fhs-opensource · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the file /vueLogin. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249869 was assigned to this vulnerability.
- Product
- iparking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE.CVE-2024-0301 · Other software · fhs-opensource · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868.
- Product
- iparking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical.CVE-2024-0297 · Other software · Totolink · reported by VulDBHigh 7.3
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249863. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical.CVE-2024-0296 · Other software · Totolink · reported by VulDBHigh 7.3
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249862 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0295 · Other software · Totolink · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249861 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0294 · Other software · Totolink · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249860. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0293 · Other software · Totolink · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130.CVE-2024-0292 · Other software · Totolink · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1.CVE-2023-7215 · Other software · Chanzhaoyu · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779.
- Product
- chatgpt-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216.CVE-2023-7214 · Other software · Totolink · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v8 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249770 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216.CVE-2023-7213 · Other software · Totolink · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of the argument v33 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N350RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112.CVE-2023-7212 · Other software · Dedecms · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmxwjm7x03.feishu.cnvuldb.com
Jan 7, 2024A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434.CVE-2023-7208 · Other software · Totolink · reported by VulDBHigh 8
A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X2000R_V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0.CVE-2024-0266 · Other software · Project Worlds · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the component User Registration. The manipulation of the argument First Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249822 is the identifier assigned to this vulnerability.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 6, 2024A vulnerability was found in Online Job Portal 1.0 and classified as problematic.CVE-2024-0262 · Other software · Projectworlds · reported by VulDBLow 2.4
A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title><scRipt>alert(0x00C57D)</scRipt> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2024A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic.CVE-2024-0261 · Other software · Sentex · reported by VulDBMedium 5.3
A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component RNFR Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249817 was assigned to this vulnerability.
- Product
- FTPDMIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 5, 2024A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0.CVE-2024-0247 · Other software · CodeAstro · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249778 is the identifier assigned to this vulnerability.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 5, 2024A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1.CVE-2024-0246 · Other software · Icewarp · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27"()%26%25<zzz><ScRiPt>alert(document.domain)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Icewarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical.CVE-2024-0196 · Other software · Ssssssss · reported by VulDBMedium 6.3
A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249511.
- Product
- Magic-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability, which was classified as critical, was found in spider-flow 0.4.3.CVE-2024-0195 · Other software · Ssssssss · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.
- Product
- Spider-flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0.CVE-2024-0194 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of the file pages_account.php of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249509 was assigned to this vulnerability.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 2, 2024A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic.CVE-2024-0190 · Other software · RRJ · reported by VulDBLow 3.5
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file add_quiz.php of the component Quiz Handler. The manipulation of the argument Quiz Title/Quiz Description with the input </title><scRipt>alert(x)</scRipt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249503.
- Product
- Nueva Ecija Engineer Online Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic.CVE-2024-0189 · Other software · RRJ · reported by VulDBLow 3.5
A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file teacher_message.php of the component Create Message Handler. The manipulation of the argument Content with the input </title><scRipt>alert(x)</scRipt> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249502 is the identifier assigned to this vulnerability.
- Product
- Nueva Ecija Engineer Online Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7.CVE-2018-25097 · Other software · Acumos · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420.
- Product
- Design Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0.CVE-2024-0188 · Other software · RRJ · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability.
- Product
- Nueva Ecija Engineer Online Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic.CVE-2017-20188 · Email & office · Zimbra · reported by VulDBLow 2.6
A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.
- Product
- zm-ajax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic.CVE-2015-10128 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.
- Product
- rt-prettyphoto
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update rt-prettyphoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 1, 2024A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0.CVE-2024-0186 · Other software · HuiRan · reported by VulDBLow 3.7
A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444.
- Product
- Host Reseller System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical.CVE-2023-7193 · Other software · MTab · reported by VulDBMedium 4.6
A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of the component Installation. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249395. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Bookmark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7191 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7190 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7189 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1.CVE-2023-7188 · Other software · Shipping 100 · reported by VulDBMedium 5
A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The manipulation of the argument M_pwd leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-249390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Fahuo100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical.CVE-2023-7184 · Other software · 7-card · reported by VulDBMedium 5.5
A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the file shop/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249386 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Fakabao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical.CVE-2023-7183 · Other software · 7-card · reported by VulDBMedium 5.5
A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality of the file shop/alipay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249385 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Fakabao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 30, 2023A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical.CVE-2023-7181 · Other software · Muyun · reported by VulDBMedium 4.7
A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DedeBIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical.CVE-2023-7180 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023TerraClassifieds – Simple Classifieds: Unrestricted Upload of File with Dangerous TypeCVE-2023-51473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.
- Product
- TerraClassifieds – Simple Classifieds
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update TerraClassifieds – Simple Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical.CVE-2023-7104 · Other software · SQLite · reported by VulDBMedium 5.5
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
- Product
- SQLite3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 29, 2023A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical.CVE-2023-4467 · Other software · Poly · reported by VulDBMedium 6.2
A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.
- Product
- Trio 8800
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Dec 29, 2023A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic.CVE-2023-4466 · Other software · Poly · reported by VulDBLow 2.7
A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.
- Product
- CCX 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Dec 29, 2023A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CVE-2023-4465 · Other software · Poly · reported by VulDBLow 2.7
A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.
- Product
- Trio 8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Dec 29, 2023A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600CVE-2023-4464 · Other software · Poly · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.
- Product
- Trio 8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.