Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 58 of 87
Dec 10, 2023A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020.CVE-2023-6655 · Other software · Hongjing · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.
- Product
- e-HR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2023A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0.CVE-2023-6654 · Websites & servers · phpems · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.
- Product
- phpems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 10, 2023A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0.CVE-2023-6647 · Other software · AMTT · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument Type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247340. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HiBOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023A vulnerability classified as problematic has been found in linkding 1.23.0.CVE-2023-6646 · Other software · Sissbruecker · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.23.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-247338 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early, responded in a very professional manner and immediately released a fixed version of the affected product.
- Product
- Linkding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtreasure-blarney-085.notion.site
Dec 8, 2023A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1.CVE-2023-6615 · Other software · Typecho · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-247250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A vulnerability classified as problematic was found in Typecho 1.2.1.CVE-2023-6614 · Other software · Typecho · reported by VulDBLow 2.7
A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A vulnerability classified as problematic has been found in Typecho 1.2.1.CVE-2023-6613 · Other software · Typecho · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the component Logo Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical.CVE-2023-6608 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/notify/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-247244. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical.CVE-2023-6607 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/wiki/cp/manage/delete.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247243. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical.CVE-2023-6581 · Network & remote access · D-Link · reported by VulDBMedium 5.5
A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/workidajax.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR.CVE-2023-6580 · Network & remote access · D-Link · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_express_devices/smartqos_normal_devices leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DIR-846
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A vulnerability, which was classified as critical, has been found in osCommerce 4.CVE-2023-6579 · Websites & servers · Oscommerce · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-247160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Oscommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Dec 7, 2023A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x.CVE-2023-6578 · Other software · Software AG · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup may request username and password. By just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able to see details like internal IPs, ports, and versions. In some cases if access to /assets/ is refused, you may enter /assets/x as a wrong value, then come back to /assets/ which we will show the requested data. It appears that insufficient access control is depending on referrer header data. VDB-247158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WebMethods
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical.CVE-2023-6574 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2023A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic.CVE-2018-25094 · Other software · ระบบบัญชีออนไลน์ · reported by VulDBLow 3.5
A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.
- Product
- Online Accounting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2023A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0.CVE-2023-6472 · Websites & servers · Phpems · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0. This issue affects some unknown processing of the file app\content\cls\api.cls.php of the component Content Section Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246629 was assigned to this vulnerability.
- Product
- Phpems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability classified as problematic was found in ZenTao PMS 18.8.CVE-2023-6439 · Other software · Easycorp · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246439.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.CVE-2023-6438 · Other software · Thecosy · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /WebArticle/articles/ of the component Like Handler. The manipulation leads to improper enforcement of a single, unique action. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246438 is the identifier assigned to this vulnerability.
- Product
- IceCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record124.71.147.32vuldb.com
Nov 30, 2023A vulnerability classified as problematic was found in NotePad++ up to 8.1.CVE-2023-6401 · Other software · Notepad-plus-plus · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2023A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0.CVE-2023-6309 · Other software · moses-smt · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknown part of the file contrib/iSenWeb/trans_result.php. The manipulation of the argument input1 leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246135.
- Product
- mosesdecoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2023A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017.CVE-2023-6308 · Other software · Xiamen Four-Faith · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue is some unknown functionality of the component Apache Struts. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Video Surveillance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2023A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1.CVE-2023-6307 · Other software · jeecgboot · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JimuReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2023A vulnerability was found in CSZCMS 1.3.0 and classified as critical.CVE-2023-6302 · Other software · Cskaza · reported by VulDBMedium 4.7
A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2023A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1.CVE-2023-6299 · Other software · Apryse · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument.java of the component Reference Table Handler. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.0.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246125 was assigned to this vulnerability. NOTE: The vendor was contacted early about this vulnerability. The fix was introduced in the iText 8.0.2 release on October 25th 2023, prior to the disclosure.
- Product
- iText
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comkb.itextpdf.com
Nov 26, 2023A vulnerability classified as problematic was found in Apryse iText 8.0.2.CVE-2023-6298 · Other software · Apryse · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Product
- iText
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comkb.itextpdf.com
Nov 24, 2023A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9.CVE-2023-6276 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246105 was assigned to this vulnerability.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A vulnerability has been found in Intelbras RX 1500 1.1.9 and classified as problematic.CVE-2023-6103 · Other software · Intelbras · reported by VulDBLow 2.4
A vulnerability has been found in Intelbras RX 1500 1.1.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /WiFi.html of the component SSID Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RX 1500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1.CVE-2023-6102 · Other software · Maiwei · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /Content/Plugins/uploader/FileChoose.html?fileUrl=/Upload/File/Pics/&parent. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-245064. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Safety Production Control Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A vulnerability, which was classified as problematic, has been found in Maiwei Safety Production Control Platform 4.1.CVE-2023-6101 · Other software · Maiwei · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Maiwei Safety Production Control Platform 4.1. This issue affects some unknown processing of the file /TC/V2.7/ha.html of the component Intelligent Monitoring. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Safety Production Control Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A vulnerability classified as problematic was found in Maiwei Safety Production Control Platform 4.1.CVE-2023-6100 · Other software · Maiwei · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Maiwei Safety Production Control Platform 4.1. This vulnerability affects unknown code of the file /api/DataDictionary/GetItemList. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-245062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Safety Production Control Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1.CVE-2023-6099 · Other software · Shenzhen Youkate Industrial · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Facial Love Cloud Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2023Motors – Car Dealer, Classifieds & Listing: Server-Side Request Forgery (SSRF)CVE-2023-46207 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.
- Product
- Motors – Car Dealer, Classifieds & Listing
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical.CVE-2023-6084 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VU_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2023A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01.CVE-2023-5959 · Other software · Byzoro · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9.CVE-2023-6054 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244875. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9.CVE-2023-6053 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the file general/system/censor_words/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244874 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.CVE-2023-46894 · Other software · Espressif · reported by MITREHigh 7.5
An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.
- Product
- Esptool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9.CVE-2023-6052 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/module/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244872. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
- Product
- Directorist – WordPress Business Directory Plugin with Classified Ads Listings
- Affected
- up to 7.7.1
- What to do
- Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22.CVE-2021-4431 · Other software · msyk · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22. Affected is an unknown function of the file FMDataAPI_Sample.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 23 is able to address this issue. The patch is identified as 3bd1709a8f7b1720529bf5dfc9855ad609f436cf. It is recommended to upgrade the affected component. VDB-244494 is the identifier assigned to this vulnerability.
- Product
- FMDataAPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023A vulnerability classified as problematic was found in dstar2018 Agency up to 61.CVE-2019-25156 · Other software · dstar2018 · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument QSType/QuickSearch leads to cross site scripting. The attack can be launched remotely. The patch is named 975b56953efabb434519d9feefcc53685fb8d0ab. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495.
- Product
- Agency
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6.CVE-2021-4430 · Other software · Ortus Solutions · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address this issue. The identifier of the patch is a3aa62daea2e44c76d08d1eac63768cd928cd69e. It is recommended to upgrade the affected component. The identifier VDB-244485 was assigned to this vulnerability.
- Product
- ColdBox Elixir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.CVE-2023-5917 · Websites & servers · Phpbb · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1.CVE-2023-5916 · Other software · Lissy93 · reported by VulDBMedium 4.3
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.
- Product
- Dashy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtreasure-blarney-085.notion.site
Nov 1, 2023A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic.CVE-2023-5910 · Other software · Popojicms · reported by VulDBLow 2.6
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress.CVE-2007-10003 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
- Product
- The Hackers Diet
- Affected
- up to 0.9.6b
- What to do
- Affects up to 0.9.6b. Update The Hackers Diet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2023A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress.CVE-2005-10002 · WordPress plugins & themes · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
- Product
- almosteffortless secure-files
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update almosteffortless secure-files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2023A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3.CVE-2023-5837 · Other software · AlexanderLivanov · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3. This vulnerability affects unknown code of the file profile.php of the component Cookie Handler. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243802 is the identifier assigned to this vulnerability.
- Product
- FotosCMS2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023A vulnerability classified as problematic was found in hu60t hu60wap6.CVE-2023-5835 · Other software · hu60t · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in hu60t hu60wap6. Affected by this vulnerability is the function markdown of the file src/class/ubbparser.php. The manipulation leads to cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named a1cd9f12d7687243bfcb7ce295665acb83b9174e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243775.
- Product
- hu60wap6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023A vulnerability classified as critical has been found in ColumbiaSoft Document Locator.CVE-2023-5830 · Other software · ColumbiaSoft · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.
- Product
- Document Locator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.