Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 60 of 87
Sep 29, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0.CVE-2023-5287 · Other software · Beecms · reported by VulDBLow 2.4
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Beecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability classified as critical was found in Tongda OA 2017.CVE-2023-5285 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Tongda OA 2017. Affected by this vulnerability is an unknown functionality of the file general/hr/recruit/recruitment/delete.php. The manipulation of the argument RECRUITMENT_ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-240913 was assigned to this vulnerability.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability was found in DedeBIZ 6.2 and classified as critical.CVE-2023-5268 · Other software · Dedebiz · reported by VulDBMedium 6.3
A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtml_taglist_action.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240881 was assigned to this vulnerability.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability has been found in Tongda OA 2017 and classified as critical.CVE-2023-5267 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/hr_pool/delete.php. The manipulation of the argument EXPERT_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-240880.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability, which was classified as critical, was found in DedeBIZ 6.2.CVE-2023-5266 · Other software · Dedebiz · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tags_main.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240879.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability, which was classified as critical, has been found in Tongda OA 2017.CVE-2023-5265 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in Tongda OA 2017. Affected by this issue is some unknown functionality of the file general/hr/manage/staff_transfer/delete.php. The manipulation of the argument TRANSFER_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240878 is the identifier assigned to this vulnerability.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability classified as critical was found in huakecms 3.0.CVE-2023-5264 · Other software · Huakecms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in huakecms 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/cms_content.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240877 was assigned to this vulnerability.
- Product
- Huakecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability was found in ZZZCMS 2.1.7 and classified as critical.CVE-2023-5263 · Other software · Zzzcms · reported by VulDBMedium 6.3
A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the component Database Backup File Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240872.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical.CVE-2023-5262 · Other software · OpenRapid · reported by VulDBMedium 6.3
A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/config/uploadicon.php. The manipulation of the argument fileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240871.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability, which was classified as critical, was found in Tongda OA 2017.CVE-2023-5261 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240870 is the identifier assigned to this vulnerability.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability classified as problematic was found in ForU CMS.CVE-2023-5259 · Other software · ForU · reported by VulDBLow 2.7
A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-240868.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1.CVE-2023-5258 · Other software · OpenRapid · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f.CVE-2023-5223 · Other software · HimitZH · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240365 was assigned to this vulnerability.
- Product
- HOJ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0.CVE-2023-5222 · Other software · Viessmann · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vitogate 300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A vulnerability classified as critical has been found in ForU CMS.CVE-2023-5221 · Other software · ForU · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly crCVE-2023-30961 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.
- Product
- com.palantir.acme:gotham-fe-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Sep 25, 2023Data security classification vulnerability in the DDMP module.CVE-2023-41293 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical.CVE-2023-5154 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240250 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231.CVE-2023-5153 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231.CVE-2023-5152 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argument sql leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240248. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231.CVE-2023-5151 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231.CVE-2023-5150 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-240246 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical.CVE-2023-5146 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240242 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical.CVE-2023-5145 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240241 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231.CVE-2023-5144 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /sysmanage/updateos.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240240. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231.CVE-2023-5143 · Network & remote access · D-Link · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some unknown processing of the file /log/webmailattach.php. The manipulation of the argument table_name leads to an unknown weakness. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240239. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Sep 24, 2023A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3CVE-2023-5142 · Other software · H3C · reported by VulDBLow 3.7
A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GR-1100-P
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1.CVE-2023-5033 · Other software · OpenRapid · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239877 was assigned to this vulnerability.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability has been found in Tongda OA up to 11.10 and classified as critical.CVE-2023-5030 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA up to 11.10 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/plan/delete.php. The manipulation of the argument PLAN_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239872.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability, which was classified as critical, was found in mccms 2.6.CVE-2023-5029 · Other software · Chshcms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239871.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme.CVE-2023-5028 · Other software · China Unicom · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown functionality. The manipulation leads to information exposure through debug log file. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-239870 is the identifier assigned to this vulnerability.
- Product
- TEWA-800G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability classified as problematic has been found in Tongda OA 11.10.CVE-2023-5026 · Other software · Tongda · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Tongda OA 11.10. Affected is an unknown function of the file /general/ipanel/menu_code.php?MENU_TYPE=FAV. The manipulation of the argument OA_SUB_WINDOW leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239868.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability was found in Tongda OA 2017 and classified as critical.CVE-2023-5023 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability was found in Tongda OA 2017 and classified as critical. Affected by this issue is some unknown functionality of the file general/hr/manage/staff_relatives/delete.php. The manipulation of the argument RELATIVES_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239864.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical.CVE-2023-5022 · Other software · Dedecms · reported by VulDBMedium 5.5
A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_templets_post.php. The manipulation of the argument activepath leads to absolute path traversal. The associated identifier of this vulnerability is VDB-239863.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability, which was classified as critical, has been found in 07FLY CRM V2.CVE-2023-5020 · Other software · 07FLY · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown processing of the file /index.php/sysmanage/Login/login_auth/ of the component Administrator Login Page. The manipulation of the argument account leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239861 was assigned to this vulnerability.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability classified as critical was found in Tongda OA.CVE-2023-5019 · Other software · Tongda · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staff_reinstatement/delete.php. The manipulation of the argument REINSTATEMENT_ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-239860.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2023A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical.CVE-2023-5014 · Other software · Sakshi2610 · reported by VulDBMedium 6.3
A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfood.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239855.
- Product
- Food Ordering Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2023A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic.CVE-2023-5013 · Other software · Pluck · reported by VulDBLow 2.6
A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2023A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201.CVE-2023-5012 · Other software · Topaz · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability.
- Product
- OFD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui.CVE-2023-4988 · Other software · Bettershop · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action=uploadImg. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-239799.
- Product
- LaikeTui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7.CVE-2023-4987 · Other software · infinitietech · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the file /home/get_tasks_list of the component GET Parameter Handler. The manipulation of the argument project/status/user_id/sort/search leads to sql injection. VDB-239798 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- taskhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Sep 15, 2023A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901.CVE-2023-4986 · Other software · Supcon · reported by VulDBLow 2.5
A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the file Project.xml. The manipulation leads to password hash with insufficient computational effort. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-239797 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- InPlant SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Sep 15, 2023A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901.CVE-2023-4985 · Other software · Supcon · reported by VulDBMedium 5.9
A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The manipulation leads to improper authentication. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239796. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- InPlant SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Sep 12, 2023Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issueCVE-2023-3711 · Other software · Honeywell · reported by psirt@honeywell.comMedium 6.4
Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
- Product
- PM23/43
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhsmftp.honeywell.comhsmftp.honeywell.com
Sep 9, 2023A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906.CVE-2023-4873 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4852 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/database/optimize. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239261 was assigned to this vulnerability.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4851 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=dashboard/position/edit&op=member. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239260.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2023A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5.CVE-2023-4850 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=dashboard/position/del. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239259.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2023A vulnerability, which was classified as critical, has been found in IBOS OA 4.5.5.CVE-2023-4849 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in IBOS OA 4.5.5. Affected by this issue is some unknown functionality of the file ?r=file/dashboard/trash&op=del. The manipulation of the argument fids leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239258 is the identifier assigned to this vulnerability.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807.CVE-2023-4748 · Other software · Yongyou · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238637 was assigned to this vulnerability.
- Product
- UFIDA-NC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.