Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 61 of 87
Sep 3, 2023A vulnerability classified as critical was found in DedeCMS 5.7.110.CVE-2023-4747 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519.CVE-2023-4746 · Other software · TOTOLINK · reported by VulDBHigh 8.8
A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnerability is a format string issue. But the impact is to bypass the validation which leads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238635.
- Product
- N200RE V5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 3, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4742 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4741 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-238630 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5.CVE-2023-4740 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820.CVE-2023-4739 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability was found in PlayTube 3.0.1 and classified as problematic.CVE-2023-4714 · Other software · playtube · reported by VulDBMedium 4.3
A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- playtube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Sep 1, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-4713 · Other software · IBOS · reported by VulDBMedium 5.5
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9.CVE-2023-4712 · Other software · Xintian · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Table Integrated Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819.CVE-2023-4711 · Network & remote access · D-Link · reported by VulDBMedium 5
A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-238574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DAR-8000-10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability classified as problematic was found in TOTVS RM 12.1.CVE-2023-4710 · Other software · TOTVS · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A vulnerability classified as problematic has been found in TOTVS RM 12.1.CVE-2023-4709 · Other software · TOTVS · reported by VulDBLow 2.3
A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <pages validateRequest="true" [...] viewStateEncryptionMode="Always" />. It is recommended to change the configuration settings. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation."
- Product
- RM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtdn.totvs.comvuldb.com
Aug 27, 2023A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui.CVE-2023-4559 · Other software · Bettershop · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-238160.
- Product
- LaikeTui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731.CVE-2023-4534 · Other software · NeoMind · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/portal/action/Link. The manipulation of the argument link leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238026 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Fusion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordl6x.notion.sitevuldb.com
Aug 20, 2023A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical.CVE-2023-4448 · Other software · OpenRapid · reported by VulDBMedium 6.3
A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2023A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical.CVE-2023-4447 · Other software · OpenRapid · reported by VulDBMedium 6.3
A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. This vulnerability affects unknown code of the file admin/article-chat.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237568.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2023A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1.CVE-2023-4446 · Other software · OpenRapid · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237567.
- Product
- RapidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2023A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811.CVE-2023-4445 · Other software · Mini · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the file product/1/1?test=1&test2=2&. The manipulation of the argument orderBy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237566 is the identifier assigned to this vulnerability.
- Product
- Mini-tmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical.CVE-2023-4412 · Other software · TOTOLINK · reported by VulDBMedium 6.3
A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237515. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX1200L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 18, 2023A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical.CVE-2023-4411 · Other software · TOTOLINK · reported by VulDBMedium 6.3
A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-237514 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX1200L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 18, 2023A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023.CVE-2023-4410 · Other software · TOTOLINK · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237513 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX1200L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 18, 2023A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6.CVE-2023-4409 · Other software · Happysoft · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237512.
- Product
- Nbs&happysoftwechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4.CVE-2023-4407 · Other software · Codecanyon · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.
- Product
- Credit Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 16, 2023A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic.CVE-2023-4392 · Other software · Control iD · reported by VulDBLow 3.7
A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237380. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Gerencia Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordl6x.notion.sitevuldb.com
Aug 16, 2023A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic.CVE-2023-4384 · Other software · MaximaTech · reported by VulDBLow 3.7
A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to missing encryption of sensitive data. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Portal Executivo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordl6x.notion.sitevuldb.com
Aug 16, 2023A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux.CVE-2023-4383 · Other software · MicroWorld · reported by VulDBHigh 7.8
A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Anti-Virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 16, 2023A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1.CVE-2023-4382 · Other software · tdevs · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hyip Rio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 9, 2023Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, AuthenticatioCVE-2023-3632 · Other software · Sifir Bes Education and Informatics · reported by iletisim@usom.gov.trCritical 9.8
Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass. This issue affects Kunduz - Homework Helper App: before 6.2.3.
- Product
- Kunduz - Homework Helper App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 5, 2023A vulnerability was found in mooSocial mooTravel 3.1.8 and classified as problematic.CVE-2023-4175 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability was found in mooSocial mooTravel 3.1.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. VDB-236210 is the identifier assigned to this vulnerability.
- Product
- mooTravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic.CVE-2023-4174 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-236209 was assigned to this vulnerability.
- Product
- mooStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 5, 2023A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6.CVE-2023-4173 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.
- Product
- mooStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 5, 2023A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-4172 · Other software · Chengdu · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-4171 · Other software · Chengdu · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic.CVE-2023-4167 · Other software · Media Browser · reported by VulDBLow 3.5
A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-236183.
- Product
- Emby Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability has been found in Tongda OA and classified as critical.CVE-2023-4166 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability has been found in Tongda OA and classified as critical. This vulnerability affects unknown code of the file general/system/seal_manage/dianju/delete_log.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-236182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability, which was classified as critical, was found in Tongda OA.CVE-2023-4165 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delete_seal.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236181 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical.CVE-2023-4120 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023A vulnerability has been found in Academy LMS 6.0 and classified as problematic.CVE-2023-4119 · Other software · Academy · reported by VulDBMedium 4.3
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 3, 2023A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0.CVE-2023-4118 · Other software · Iscute · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0. This affects an unknown part of the component Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235965 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cute Http File Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0.CVE-2023-4117 · Websites & servers · PHP Jabbers · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Rental Property Booking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 3, 2023A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0.CVE-2023-4116 · Websites & servers · PHP Jabbers · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Taxi Booking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 3, 2023A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0.CVE-2023-4115 · Websites & servers · PHP Jabbers · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cleaning Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 3, 2023A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic.CVE-2023-4111 · Websites & servers · PHP Jabbers · reported by VulDBMedium 4.3
A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Bus Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 2, 2023A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic.CVE-2023-4110 · Websites & servers · PHP Jabbers · reported by VulDBLow 3.5
A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 28, 2023A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1.CVE-2023-3990 · Other software · Mingsoft · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9.CVE-2023-3984 · Websites & servers · phpscriptpoint · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking_method leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-235605 was assigned to this vulnerability.
- Product
- RecipePoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0.CVE-2023-3970 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability.
- Product
- Availability Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0.CVE-2023-3969 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568.
- Product
- Availability Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic.CVE-2023-3944 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality of the file page.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235400. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lawyer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability was found in phpscriptpoint Car Listing 1.6 and classified as critical.CVE-2023-3859 · Websites & servers · phpscriptpoint · reported by VulDBMedium 6.3
A vulnerability was found in phpscriptpoint Car Listing 1.6 and classified as critical. This issue affects some unknown processing of the file /search.php of the component GET Parameter Handler. The manipulation of the argument brand_id/model_id/car_condition/car_category_id/body_type_id/fuel_type_id/transmission_type_id/year/mileage_start/mileage_end/country/state/city leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235211. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Car Listing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.