Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
350 results · page 6 of 7
May 21, 2020Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.CVE-2019-20804 · Other software · Gilacms · reported by MITREHigh 8.8
Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 21, 2020Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.CVE-2019-20803 · Other software · Gilacms · reported by MITREMedium 6.1
Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 6, 2020Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.CVE-2020-5513 · Other software · Gilacms · reported by MITREMedium 6.8
Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgilacms.cominfosecdb.wordpress.com
Jan 6, 2020Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.CVE-2020-5512 · Other software · Gilacms · reported by MITREMedium 6.8
Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosecdb.wordpress.cominfosecdb.wordpress.com
Jan 6, 2020Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.CVE-2020-5515 · Other software · Gilacms · reported by MITREHigh 7.2
Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 6, 2020Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.CVE-2020-5514 · Other software · Gilacms · reported by MITRECritical 9.1
Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosecdb.wordpress.cominfosecdb.wordpress.com
Oct 13, 2019Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php.CVE-2019-17536 · Other software · Gilacms · reported by MITREMedium 4.9
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Oct 13, 2019Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.CVE-2019-17535 · Other software · Gilacms · reported by MITREMedium 6.1
Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Sep 21, 2019Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.CVE-2019-16679 · Other software · Gilacms · reported by MITREMedium 4.9
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 5, 2019Gila CMS 1.9.1 has XSS.CVE-2019-9647 · Other software · Gilacms · reported by MITREMedium 6.1
Gila CMS 1.9.1 has XSS.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgilacms.com
Apr 25, 2019core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.CVE-2019-11515 · Other software · Gilacms · reported by MITREMedium 4.9
core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisk123456.blogspot.comcisk123456.blogspot.com
Apr 22, 2019Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.CVE-2019-11456 · Other software · Gilacms · reported by MITREHigh 8.8
Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisk123456.blogspot.comcisk123456.blogspot.com
Mar 27, 2019Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecifiCVE-2019-5926 · Other software · Project Kinaga · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- KinagaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.CVE-2019-8418 · Other software · Seacms · reported by MITREHigh 8.8
SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2019An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.CVE-2019-7568 · Other software · Baijiacms Project · reported by MITRECritical 9.8
An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.CVE-2018-19918 · Other software · Cuppacms · reported by MITREMedium 5.4
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2018CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.CVE-2018-19559 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECVE-2018-19350 · Other software · Seacms · reported by MITREMedium 5.4
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.CVE-2018-19349 · Other software · Seacms · reported by MITREHigh 7.2
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.CVE-2018-17365 · Other software · Seacms · reported by MITREHigh 7.5
SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.51cto.comgithub.com
Sep 21, 2018An issue was discovered in SeaCMS 6.64.CVE-2018-17321 · Other software · Seacms · reported by MITREMedium 6.1
An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecwk.blogspot.comsecwk.blogspot.com
Sep 21, 2018SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.CVE-2018-16822 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.51cto.comseacms.net
Sep 21, 2018SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.CVE-2018-16821 · Other software · Seacms · reported by MITREMedium 5.3
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.51cto.comseacms.net
Sep 21, 2018Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.CVE-2018-17300 · Other software · Cuppacms · reported by MITREMedium 4.8
Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2018An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2.CVE-2018-17102 · Other software · Quickappscms · reported by MITREHigh 8.8
An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.
- Product
- Quickapps CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2018An issue was discovered in SeaCMS 6.64.CVE-2018-17062 · Other software · Seacms · reported by MITREMedium 6.1
An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameter.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecwk.blogspot.comsecwk.blogspot.com
Sep 8, 2018An issue is discovered in baijiacms V4.CVE-2018-16725 · Other software · Baijiacms Project · reported by MITREMedium 6.1
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2018An issue is discovered in baijiacms V4.CVE-2018-16724 · Other software · Baijiacms Project · reported by MITRECritical 9.8
An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2018Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via tCVE-2018-16622 · Other software · Html-js · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018An issue was discovered in SeaCMS through 6.61.CVE-2018-16446 · Other software · Seamcms · reported by MITREHigh 7.5
An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018An issue was discovered in SeaCMS through 6.61.CVE-2018-16445 · Other software · Seacms · reported by MITRECritical 9.8
An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admin_topic_vod.php request.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018An issue was discovered in SeaCMS 6.61.CVE-2018-16444 · Other software · Seacms · reported by MITRECritical 9.1
An issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018The issue was discovered in IdeaCMS through 2016-04-30.CVE-2018-16372 · Other software · Ideacms · reported by MITREMedium 6.1
The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.CVE-2018-16348 · Other software · Seacms · reported by MITREMedium 4.8
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.CVE-2018-16343 · Other software · Seacms · reported by MITREHigh 7.2
SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzhinianyuxin.postach.iogithub.com
Sep 2, 2018An issue was discovered in AuraCMS 2.3.CVE-2018-16338 · Other software · Auracms · reported by MITREHigh 8.8
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
- Product
- Auracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2018AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.CVE-2018-15199 · Other software · Auracms · reported by MITREMedium 5.4
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
- Product
- Auracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2018SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php).CVE-2018-14910 · Other software · Seacms · reported by MITREHigh 8.8
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.CVE-2018-14517 · Other software · Seacms · reported by MITREMedium 6.1
SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2018SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.phpCVE-2018-14421 · Other software · Seacms · reported by MITREHigh 8.8
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhexo.imagemlt.xyzhexo.imagemlt.xyz
Jul 8, 2018An issue was discovered in SeaCMS 6.61.CVE-2018-13445 · Other software · Seacms · reported by MITREHigh 8.8
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2018An issue was discovered in SeaCMS 6.61.CVE-2018-13444 · Other software · Seacms · reported by MITREHigh 8.8
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).CVE-2018-12431 · Other software · Seacms · reported by MITREMedium 4.8
SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2018SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.CVE-2018-11583 · Other software · Seacms · reported by MITREMedium 6.1
SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 27, 2018An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105.CVE-2018-10503 · Other software · Baijiacms Project · reported by MITREHigh 8.8
An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2018baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.CVE-2018-10249 · Other software · Baijiacms Project · reported by MITREHigh 8.8
baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrayon-xin.github.iocrayon-xin.github.io
Apr 19, 2018baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request.CVE-2018-10219 · Other software · Baijiacms Project · reported by MITREMedium 5.3
baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2018Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, whCVE-2018-7486 · Other software · Blueriver · reported by MITREHigh 7.2
Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude("../pathname/executable.jpeg")[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.
- Product
- Muracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbekhzod0725.github.iobekhzod0725.github.io
Dec 12, 2017SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with datCVE-2017-17561 · Other software · Seacms Project · reported by MITREHigh 7.2
SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjianshu.comgist.github.com
Apr 27, 2017Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cCVE-2017-8302 · Other software · Blueriver · reported by MITREMedium 5.4
Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp_nextn.cfm, admin/core/views/cusers/inc/dsp_search_form.cfm, admin/core/views/cusers/inc/dsp_users_list.cfm, admin/core/views/cusers/list.cfm, and admin/core/views/cusers/listusers.cfm.
- Product
- Muracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.