Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 57 of 87
Dec 29, 2023A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60.CVE-2023-4463 · Other software · Poly · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.
- Product
- CCX 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Dec 29, 2023A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700CVE-2023-4462 · Other software · Poly · reported by VulDBLow 3.7
A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.
- Product
- Trio 8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfahrplan.events.ccc.degithub.com
Dec 29, 2023A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0.CVE-2023-7166 · Other software · Xxyopen · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1.CVE-2023-7161 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview.CVE-2023-7152 · Other software · Micropython · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.
- Product
- Micropython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical.CVE-2023-7148 · Other software · ShifuML · reported by VulDBMedium 5
A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpression leads to code injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249151.
- Product
- shifu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 28, 2023A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10.CVE-2023-7147 · Other software · gopeak · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.
- Product
- MasterLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 28, 2023A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10.CVE-2023-7146 · Other software · gopeak · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.
- Product
- MasterLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 28, 2023A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10.CVE-2023-7145 · Other software · gopeak · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.
- Product
- MasterLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 28, 2023A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10.CVE-2023-7144 · Other software · gopeak · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.
- Product
- MasterLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 28, 2023GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50845 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
- Product
- GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 27, 2023A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2.CVE-2023-7116 · Other software · WeiYe-Jing · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.
- Product
- datax-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic.CVE-2015-10127 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
- Product
- PlusCaptcha
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update PlusCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3.CVE-2023-7098 · Other software · icret · reported by VulDBLow 3.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- EasyImages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 24, 2023A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024.CVE-2023-7095 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.
- Product
- A7100RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2023A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2023-7094 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2023A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33.CVE-2023-7093 · Other software · KylinSoft · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kylin-system-updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 21, 2023A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4.CVE-2023-7041 · Other software · codelyfe · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248690 is the identifier assigned to this vulnerability.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4.CVE-2023-7040 · Other software · codelyfe · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023A vulnerability classified as critical has been found in Byzoro S210 up to 20231210.CVE-2023-7039 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.
- Product
- S210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023A vulnerability was found in automad up to 1.10.9 and classified as problematic.CVE-2023-7035 · Other software · Automad · reported by VulDBLow 1.9
A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Automad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical.CVE-2023-7020 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. This issue affects some unknown processing of the file general/wiki/cp/ct/view.php. The manipulation of the argument TEMP_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248567. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
- Product
- Adifier - Classified Ads
- Fixed in
- 3.1.4
- What to do
- Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical.CVE-2019-25158 · Other software · pedroetb · reported by VulDBMedium 5.5
A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vulnerability.
- Product
- tts-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical.CVE-2014-125107 · Other software · Corveda · reported by VulDBMedium 4.3
A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The patch is identified as 48fde5ffa4d76014bad260a3cbab7ada3744a4cc. It is recommended to upgrade the affected component. VDB-248270 is the identifier assigned to this vulnerability.
- Product
- PHPSandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4.CVE-2023-6908 · Other software · DFIRKuiper · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/controllers/case_management.py of the component TAR Archive Handler. The manipulation of the argument dst_path leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is 94fa135153002f651f5526c55a7240e083db8d73. It is recommended to upgrade the affected component. The identifier VDB-248277 was assigned to this vulnerability.
- Product
- Kuiper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical.CVE-2023-6907 · Other software · codelyfe · reported by VulDBMedium 5.4
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024.CVE-2023-6906 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A7100RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.CVE-2023-6905 · Other software · Jahastech · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=test&id=1 of the component Bind Request Handler. The manipulation leads to ldap injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-248267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NxFilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5.CVE-2023-6904 · Other software · Jahastech · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5. This vulnerability affects unknown code of the file /config,admin.jsp. The manipulation of the argument admin_name leads to cross-site request forgery. The attack can be initiated remotely. VDB-248266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NxFilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1.CVE-2023-6903 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/singlelogin.php?submit=1. The manipulation of the argument loginId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248265 was assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical.CVE-2023-6902 · Other software · codelyfe · reported by VulDBMedium 5.5
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-manager/upload.php. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248260.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3.CVE-2023-6901 · Other software · codelyfe · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248259.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4.CVE-2023-6900 · Other software · rmountjoy92 · reported by VulDBMedium 4.6
A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability.
- Product
- DashMachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtreasure-blarney-085.notion.sitevuldb.com
Dec 17, 2023A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4.CVE-2023-6899 · Other software · rmountjoy92 · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /settings/save_config of the component Config Handler. The manipulation of the argument value_template leads to code injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248257 was assigned to this vulnerability.
- Product
- DashMachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtreasure-blarney-085.notion.sitevuldb.com
Dec 17, 2023A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic.CVE-2023-6893 · Network & remote access · Hikvision · reported by VulDBMedium 4.3
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252.
- Product
- Intercom Broadcasting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability has been found in PeaZip 9.4.0 and classified as problematic.CVE-2023-6891 · Other software · Peazip · reported by VulDBMedium 5.3
A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248251. NOTE: Vendor was contacted early, confirmed the existence of the flaw and immediately worked on a patched release.
- Product
- Peazip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpeazip.github.iovuldb.com
Dec 16, 2023A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0.CVE-2023-6888 · Other software · PHZ76 · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0. This vulnerability affects the function ParseRequestLine of the file RtspMesaage.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RtspServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630.CVE-2023-6887 · Other software · saysky · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248247.
- Product
- ForestBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6853 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugins/officeLive/app.php. The manipulation of the argument path leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The identifier of the patch is 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The identifier VDB-248221 was assigned to this vulnerability.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6852 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The name of the patch is 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248220.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023Adifier - Classified Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49187 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
- Product
- Adifier - Classified Ads
- Fixed in
- 3.1.4
- What to do
- Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 13, 2023A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic.CVE-2023-6774 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /accounts_con/register_account. The manipulation of the argument Username with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247910 is the identifier assigned to this vulnerability.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 13, 2023A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic.CVE-2023-6773 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /accounts_con/register_account of the component User Creation Handler. The manipulation of the argument account_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247909 was assigned to this vulnerability.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 13, 2023A vulnerability, which was classified as critical, was found in OTCMS 7.01.CVE-2023-6772 · Other software · Otcms · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1.CVE-2023-6762 · Other software · Thecosy · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ of the component Article Handler. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-247890 is the identifier assigned to this vulnerability.
- Product
- IceCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record39.106.130.187vuldb.com
Dec 13, 2023A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1.CVE-2023-6761 · Other software · Thecosy · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247889 was assigned to this vulnerability.
- Product
- IceCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record39.106.130.187vuldb.com
Dec 13, 2023A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1.CVE-2023-6760 · Other software · Thecosy · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247888.
- Product
- IceCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record39.106.130.187vuldb.com
Dec 13, 2023A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.CVE-2023-6759 · Other software · Thecosy · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the component Love Handler. The manipulation leads to improper enforcement of a single, unique action. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247887.
- Product
- IceCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record39.106.130.187vuldb.com
Dec 13, 2023A vulnerability was found in DedeBIZ 6.2 and classified as critical.CVE-2023-6755 · Other software · Dedebiz · reported by VulDBMedium 4.7
A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/content_batchup_action.php. The manipulation of the argument endid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247883. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.