Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 59 of 87
Oct 27, 2023A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2023-5826 · Other software · Netentsec · reported by VulDBMedium 5.5
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_onlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243716. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability has been found in flusity CMS and classified as critical.CVE-2023-5812 · Other software · flusity · reported by VulDBMedium 4.7
A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tools/upload.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-243643.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability, which was classified as problematic, was found in flusity CMS.CVE-2023-5811 · Other software · flusity · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menu_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. VDB-243642 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability, which was classified as problematic, has been found in flusity CMS.CVE-2023-5810 · Other software · flusity · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability was found in flusity CMS and classified as problematic.CVE-2023-5793 · Other software · flusity · reported by VulDBLow 3.5
A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/customblock.php of the component Dashboard. The manipulation of the argument customblock_place leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 81252bc764e1de2422e79e36194bba1289e7a0a5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243599.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability classified as problematic has been found in Dragon Path 707GR1 up to 20231022.CVE-2023-5789 · Other software · Dragon Path · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in Dragon Path 707GR1 up to 20231022. Affected is an unknown function of the component Ping Diagnostics. The manipulation of the argument Host Address with the input >><img/src/onerror=alert(1)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-243594 is the identifier assigned to this vulnerability.
- Product
- 707GR1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Oct 26, 2023A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2023-5784 · Other software · Netentsec · reported by VulDBMedium 5.5
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/uploadfirewall.php. The manipulation of the argument messagecontent leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243590 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical.CVE-2023-5783 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/system/approve_center/flow_sort/flow/delete.php. The manipulation of the argument id/sort_parent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243589 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10.CVE-2023-5782 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /manage/delete_query.php of the component General News. The manipulation of the argument NEWS_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243588. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10.CVE-2023-5781 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the function DELETE_STR of the file general/system/res_manage/monitor/delete_webmail.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243587. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023A vulnerability classified as critical was found in Tongda OA 2017 11.10.CVE-2023-5780 · Other software · Tongda · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the file general/system/approve_center/flow_guide/flow_type/set_print/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic.CVE-2023-5702 · Other software · Viessmann · reported by VulDBMedium 4.3
A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vitogate 300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic.CVE-2023-5701 · Other software · vnotex · reported by VulDBMedium 4.3
A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2023-5700 · Other software · Netentsec · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/iscgwtunnel/uploadiscgwrouteconf.php. The manipulation of the argument GWLinkId leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0.CVE-2023-5699 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0. This issue affects some unknown processing of the file pages_view_client.php. The manipulation of the argument acc_name with the input Johnnie Reyes'"()&%<zzz><ScRiPt >alert(5646)</ScRiPt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243137 was assigned to this vulnerability.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0.CVE-2023-5698 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. This vulnerability affects unknown code of the file pages_deposit_money.php. The manipulation of the argument account_number with the input 421873905--><ScRiPt%20>alert(9523)</ScRiPt><!-- leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243136.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0.CVE-2023-5697 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_withdraw_money.php. The manipulation of the argument account_number with the input 287359614--><ScRiPt%20>alert(1234)</ScRiPt><!-- leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243135.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical.CVE-2023-5693 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_reset_pwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243131.
- Product
- Internet Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2023A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical.CVE-2023-5683 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023A vulnerability has been found in Tongda OA 2017 and classified as critical.CVE-2023-5682 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2023-5681 · Other software · Netentsec · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress.CVE-2012-10016 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2023A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0.CVE-2023-5582 · Other software · Zzzcms · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-242147.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability classified as critical has been found in Tongda OA 2017 11.10.CVE-2023-5497 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/delete.php. The manipulation of the argument WELFARE_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241650 is the identifier assigned to this vulnerability.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical.CVE-2023-5494 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this issue is some unknown functionality of the file /log/download.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-241646 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical.CVE-2023-5493 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241645 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5492 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 202309CVE-2023-5491 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This issue affects some unknown processing of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241643. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5490 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnerability affects unknown code of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-241642 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5489 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This affects an unknown part of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241641 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023A vulnerability, which was classified as critical, was found in codeprojects Farmacia 1.0.CVE-2023-5471 · Other software · codeprojects · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in codeprojects Farmacia 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument usario/senha leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241608.
- Product
- Farmacia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic.CVE-2023-5460 · Other software · Delta Electronics · reported by VulDBLow 3.5
A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Modbus Data Packet Handler. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241583. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WPLSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Oct 9, 2023A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical.CVE-2023-5459 · Other software · Delta Electronics · reported by VulDBMedium 6.5
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DVP32ES2 PLC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.CVE-2023-41801 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.
- Fixed in
- 4.3.1
- What to do
- Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 6, 2023A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress.CVE-2015-10126 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability.
- Fixed in
- 1.1.0
- What to do
- Update the plugin to 1.1.0 or newer.
Oct 5, 2023A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress.CVE-2015-10125 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
- Fixed in
- 3.7.3
- What to do
- Update the plugin to 3.7.3 or newer.
Oct 5, 2023A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel.CVE-2023-42755 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 1, 2023A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001.CVE-2023-5329 · Other software · Field Logic · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the component Web API. The manipulation leads to improper authentication. The exploit has been disclosed to the public and may be used. VDB-241030 is the identifier assigned to this vulnerability.
- Product
- DataCube4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2023A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2.CVE-2023-5328 · Other software · SATO · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The manipulation with the input auth=user,level1,settings; web=true leads to improper authentication. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-241029 was assigned to this vulnerability.
- Product
- CL4NX-J Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2023A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical.CVE-2023-5324 · Other software · Eero · reported by VulDBMedium 4.3
A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241024.
- Product
- Eeroos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7.CVE-2022-4956 · Other software · Caphyon · reported by VulDBHigh 7.8
A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 19.7.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-240903.
- Product
- Advanced Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordheegong.github.iovuldb.com
Sep 30, 2023A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18.CVE-2023-5313 · Websites & servers · phpkobo · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18. Affected by this vulnerability is an unknown functionality of the file ajax-poll.php of the component Poll Handler. The manipulation leads to improper enforcement of a single, unique action. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240949 was assigned to this vulnerability.
- Product
- Ajax Poll Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability was found in Online Banquet Booking System 1.0 and classified as problematic.CVE-2023-5305 · Other software · Anujk305 · reported by VulDBLow 3.5
A vulnerability was found in Online Banquet Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /mail.php of the component Contact Us Page. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-240944.
- Product
- Online Banquet Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability has been found in Online Banquet Booking System 1.0 and classified as problematic.CVE-2023-5304 · Other software · anujk305 · reported by VulDBLow 3.5
A vulnerability has been found in Online Banquet Booking System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /book-services.php of the component Service Booking. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-240943.
- Product
- online_banquet_booking_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability, which was classified as problematic, was found in Online Banquet Booking System 1.0.CVE-2023-5303 · Websites & servers · Phpgurukul · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Online Banquet Booking System 1.0. Affected is an unknown function of the file /view-booking-detail.php of the component Account Detail Handler. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. VDB-240942 is the identifier assigned to this vulnerability.
- Product
- Online Banquet Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability classified as critical was found in DedeCMS 5.7.111.CVE-2023-5301 · Other software · Dedecms · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240940.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability classified as critical has been found in TTSPlanning up to 20230925.CVE-2023-5300 · Other software · Ttsplanning · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in TTSPlanning up to 20230925. This affects an unknown part. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240939.
- Product
- Ttsplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic.CVE-2023-5296 · Other software · Xinhu · reported by VulDBMedium 4.3
A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability.
- Product
- RockOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability has been found in ECshop 4.1.1 and classified as critical.CVE-2023-5294 · Other software · Shopex · reported by VulDBMedium 4.7
A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/order.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240925 was assigned to this vulnerability.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability, which was classified as critical, was found in ECshop 4.1.5.CVE-2023-5293 · Other software · Shopex · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file /admin/leancloud.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240924.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.