Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

562new WordPress flaws this week

392,577entries in the database

4,117 results · page 60 of 83

Dec 31, 2018Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.CVE-2018-19904 · Other software · Xsltcms.org Project · reported by MITREMedium 6.1
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
Product
Xsltcms.org
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 31, 2018Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.CVE-2018-19903 · Other software · Xsltcms.org Project · reported by MITREMedium 6.1
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
Product
Xsltcms.org
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2018Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.CVE-2018-16632 · Other software · Jupo · reported by MITREMedium 4.8
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
Product
Mezzanine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.CVE-2018-20530 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
Product
Website Seller Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record suku90.wordpress.com suku90.wordpress.com
Dec 25, 2018Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.CVE-2018-20448 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
Product
Frog CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 22, 2018SZ NetChat before 7.9 has XSS in the MyName input field of the Options module.CVE-2018-20370 · Other software · The-sz · reported by MITREMedium 5.4
SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.
Product
Netchat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Dec 20, 2018HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can rCVE-2018-1000871 · Other software · Digitaldruid · reported by MITRECritical 9.8
HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can result in An attacker can dump all the database records of backend webserver. This attack appear to be exploitable via the attack can be done by anyone via specially crafted sql query passed to the "id_utente_mod=1" parameter.
Product
Hoteldruid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 17, 2018Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.CVE-2018-19933 · Other software · Bolt · reported by MITREMedium 6.1
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
Product
Bolt CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 13, 2018Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an exisCVE-2018-5411 · Other software · Pixar · reported by cret@cert.orgMedium 5.4
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable.
Product
Tractor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com kb.cert.org
Dec 13, 2018Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field wCVE-2018-19118 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain.
Product
Manageengine Adaudit Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Dec 13, 2018PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.CVE-2018-20138 · Other software · Readymadeb2bscript · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
Product
Entrepreneur B2b Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record suku90.wordpress.com suku90.wordpress.com
Dec 10, 2018PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.CVE-2018-20012 · Websites & servers · Phpcmf · reported by MITREMedium 4.8
PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
Product
Phpcmf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record phpcmf.net gitee.com
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.CVE-2018-20011 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.CVE-2018-20010 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 10, 2018DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.CVE-2018-20009 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.CVE-2018-19915 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.CVE-2018-19914 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 6, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.CVE-2018-19913 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 5, 2018DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.CVE-2018-19892 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 5, 2018login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.CVE-2018-19877 · Other software · Adiscon · reported by MITREMedium 6.1
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
Product
Loganalyzer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record loganalyzer.adiscon.com exploit-db.com
Dec 4, 2018In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 requesCVE-2018-17158 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.5
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 30, 2018PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.CVE-2018-19785 · Websites & servers · Php-proxy · reported by MITREMedium 6.1
PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.
Product
Php-proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 29, 2018i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.CVE-2018-19527 · Other software · I4 · reported by MITREMedium 6.1
i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.
Product
AI SI Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mimaz.org mimaz.org
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.CVE-2018-19752 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.CVE-2018-19751 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.CVE-2018-19750 · Other software · Domainmod · reported by MITREMedium 5.4
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Nov 29, 2018DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.CVE-2018-19749 · Other software · Domainmod · reported by MITREMedium 4.8
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
Product
Domainmod
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentCVE-2018-16089 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.5
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
Product
ThinkSystem SMM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.lenovo.com support.lenovo.com
Nov 22, 2018Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party statCVE-2018-19464 · Other software · Dismall · reported by MITREMedium 4.8
Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
Product
Discuz!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2018An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04.CVE-2018-18562 · Other software · Roche · reported by MITREHigh 8.8
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.
Product
Accu-chek Inform II Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Nov 20, 2018An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04.CVE-2018-18561 · Other software · Roche · reported by MITREHigh 8
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system.
Product
Accu-chek Inform II Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Nov 17, 2018kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.CVE-2018-19324 · Other software · Kimsq · reported by MITREMedium 5.4
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
Product
RB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > SCVE-2018-19311 · Other software · Centreon · reported by MITREMedium 5.4
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record roothc.com.br documentation.centreon.com
Nov 11, 2018In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name pCVE-2018-19170 · Other software · Jpress · reported by MITREMedium 4.8
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
Product
Jpress
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 31, 2018MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.CVE-2018-18892 · Other software · 1234n · reported by MITRECritical 9.8
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.
Product
Minicms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com patec.cn
Oct 31, 2018S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).CVE-2018-18887 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
Product
S-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iwantacve.cn iwantacve.cn
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.CVE-2018-18743 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
Product
Semcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.CVE-2018-18740 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
Product
Semcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2018An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.CVE-2018-18739 · Other software · Sem-cms · reported by MITREMedium 4.8
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
Product
Semcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2018Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.CVE-2018-18553 · Other software · Leanote · reported by MITREMedium 6.1
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
Product
Leanote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 18, 2018Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.CVE-2018-12374 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Oct 18, 2018A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node CVE-2018-12363 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 16, 2018A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.CVE-2018-18307 · Other software · Alchemy-cms · reported by MITREMedium 6.1
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."
Product
Alchemy CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 9, 2018The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page.CVE-2018-18198 · Other software · Redaxo · reported by MITREMedium 6.1
The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request.
Product
Redaxo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2018Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.CVE-2018-18029 · Other software · Naviwebs · reported by MITREMedium 5.4
Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.
Product
Navigate CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bitbucket.org bitbucket.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 5, 2018The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.CVE-2014-10075 · Other software · Karo Project · reported by MITRECritical 9.8
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.
Product
Karo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vapid.dhs.org vapidlabs.com
Oct 1, 2018The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.CVE-2018-15702 · Network & remote access · TP-Link · reported by vulnreport@tenable.comHigh 8.8
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.
Product
TP-Link TL-WRN841N
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Sep 28, 2018Vanilla before 2.6.1 allows XSS via the email field of a profile.CVE-2018-17571 · Other software · Vanillaforums · reported by MITREMedium 6.1
Vanilla before 2.6.1 allows XSS via the email field of a profile.
Product
Vanilla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.