Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 62 of 87
Jul 23, 2023A vulnerability has been found in phpscriptpoint Car Listing 1.6 and classified as problematic.CVE-2023-3858 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability has been found in phpscriptpoint Car Listing 1.6 and classified as problematic. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument country/state/city leads to cross site scripting. The attack can be initiated remotely. VDB-235210 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Car Listing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15.CVE-2023-3857 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15. This affects an unknown part of the file /product.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235209 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15.CVE-2023-3856 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15. Affected by this issue is some unknown functionality of the file /blog-single.php. The manipulation of the argument slug leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235208. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5.CVE-2023-3855 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionality of the file /search-result.php. The manipulation of the argument kw/lc/ct/cp/p leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235207. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JobSeeker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability classified as critical has been found in phpscriptpoint BloodBank 1.1.CVE-2023-3854 · Websites & servers · phpscriptpoint · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in phpscriptpoint BloodBank 1.1. Affected is an unknown function of the file /search of the component POST Parameter Handler. The manipulation of the argument country/city/blood_group_id leads to sql injection. It is possible to launch the attack remotely. VDB-235206 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BloodBank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2.CVE-2023-3849 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- mooDating
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 23, 2023A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2.CVE-2023-3848 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235199. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- mooDating
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 23, 2023A vulnerability classified as problematic was found in mooSocial mooDating 1.2.CVE-2023-3847 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- mooDating
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 23, 2023A vulnerability classified as problematic has been found in mooSocial mooDating 1.2.CVE-2023-3846 · Other software · mooSocial · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235197 was assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- Product
- mooDating
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 23, 2023A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical.CVE-2023-3842 · Other software · Pointware · reported by VulDBHigh 7.8
A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Files (x86)\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-235193 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EasyInventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic.CVE-2023-3841 · Other software · Nxfilter · reported by VulDBMedium 4.3
A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.jsp. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235192. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Nxfilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability, which was classified as problematic, was found in NxFilter 4.3.2.5.CVE-2023-3840 · Other software · Nxfilter · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in NxFilter 4.3.2.5. This affects an unknown part of the file /report,daily.jsp?stime=2023%2F07%2F12&timeOption=yesterday&. The manipulation of the argument user leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Nxfilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10.CVE-2023-3839 · Other software · Dedebiz · reported by VulDBMedium 4.1
A vulnerability, which was classified as problematic, has been found in DedeBIZ 6.2.10. Affected by this issue is some unknown functionality of the file /admin/sys_sql_query.php. The manipulation of the argument sqlquery leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-235190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as problematic was found in DedeBIZ 6.2.10.CVE-2023-3838 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in DedeBIZ 6.2.10. Affected by this vulnerability is an unknown functionality of the file /admin/vote_edit.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as problematic has been found in DedeBIZ 6.2.10.CVE-2023-3837 · Other software · Dedebiz · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in DedeBIZ 6.2.10. Affected is an unknown function of the file /admin/sys_sql_query.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235188. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedebiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713.CVE-2023-3836 · Network & remote access · Dahua · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Park Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability classified as problematic has been found in Bug Finder MineStack 1.0.CVE-2023-3835 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Bug Finder MineStack 1.0. This affects an unknown part of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MineStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Finounce 1.0 and classified as problematic.CVE-2023-3831 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Finounce 1.0 and classified as problematic. This issue affects some unknown processing of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Finounce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0 and classified as problematic.CVE-2023-3827 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /listplace/user/ticket/create of the component HTTP POST Request Handler. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235148. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Listplace Directory Listing Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3826 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=recruit/resume/edit&op=status of the component Interview Handler. The manipulation of the argument resumeid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235147. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7.CVE-2023-3815 · Other software · y_project · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
- Product
- RuoYi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in Hospital Management System 1.0 and classified as critical.CVE-2023-3808 · Other software · Hospital Management System Project · reported by VulDBMedium 6.3
A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patientforgotpassword.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235076.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712.CVE-2023-3805 · Other software · Xiamen Four Letter · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Video Surveillance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-3804 · Other software · Chengdu · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-3803 · Other software · Chengdu · reported by VulDBLow 2.6
A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3799 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=article/category/del of the component Delete Category Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235067. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical.CVE-2023-3798 · Other software · Chengdu · reported by VulDBMedium 5.5
A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as critical, was found in Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early WarCVE-2023-3797 · Other software · Gen Technology · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System up to 20230712. This affects an unknown part of the file /Duty/AjaxHandle/UploadFloodPlanFileUpdate.ashx. The manipulation of the argument Filedata leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier VDB-235065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0.CVE-2023-3796 · Other software · Bug Finder · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of the file /user/profile of the component Profile Picture Handler. The manipulation of the argument profile_picture leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-235064. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Foody Friend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3795 · Other software · Bug Finder · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /property of the component GET Parameter Handler. The manipulation of the argument name leads to sql injection. The associated identifier of this vulnerability is VDB-235063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ChainCity Real Estate Investment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3794 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. VDB-235062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ChainCity Real Estate Investment Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3791 · Other software · IBOS · reported by VulDBMedium 6.3
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=contact/default/export of the component Personal Office Address Book. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-235058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic.CVE-2023-3790 · Other software · Boom · reported by VulDBLow 3.5
A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic. Affected by this vulnerability is the function add of the component assets-manager. The manipulation of the argument title/description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235057 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as problematic, was found in PaulPrinting CMS 2018.CVE-2023-3789 · Other software · PaulPrinting · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in PaulPrinting CMS 2018. Affected is an unknown function of the file /account/delivery of the component Search. The manipulation of the argument s leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235056.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5.CVE-2023-3788 · Other software · ActiveITzone · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5. This issue affects some unknown processing of the component Manage Details Page. The manipulation of the argument name/phone/address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235055.
- Product
- Active Super Shop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4.CVE-2023-3787 · Other software · Codecanyon · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235054 is the identifier assigned to this vulnerability.
- Product
- Tiva Events Calender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic has been found in Aures Komet up to 20230509.CVE-2023-3786 · Other software · Aures · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulation leads to improper access controls. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-235053 was assigned to this vulnerability.
- Product
- Komet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic.CVE-2023-3761 · Other software · Intergard · reported by VulDBLow 3.7
A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-234446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SGS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic.CVE-2023-3760 · Other software · Intergard · reported by VulDBMedium 4.3
A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-234445 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SGS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0.CVE-2023-3759 · Other software · Intergard · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234444. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SGS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8.CVE-2023-3757 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Car Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic.CVE-2023-3756 · Other software · Creativeitem · reported by VulDBLow 3.5
A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is some unknown functionality of the file /home/search. The manipulation of the argument search_string leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-234428. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Atlas Business Directory Listing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic.CVE-2023-3755 · Other software · Creativeitem · reported by VulDBLow 3.5
A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /home/filter_listings. The manipulation of the argument price-range leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234427. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Atlas Business Directory Listing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0.CVE-2023-3754 · Other software · Creativeitem · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash]. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-234426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2.CVE-2023-3753 · Other software · Creativeitem · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234423. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mastery LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic.CVE-2021-4428 · WordPress plugins & themes · reported by VulDBLow 2.7
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
- Product
- what3words Autosuggest
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update what3words Autosuggest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 18, 2023A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical.CVE-2020-36762 · Other software · ONS Digital · reported by VulDBMedium 5.5
A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.
- Product
- RAS Collection Instrument
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.CVE-2023-37387 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 18, 2023A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2.CVE-2018-25088 · Other software · Blue Yonder · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.
- Product
- postgraas_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices.CVE-2023-35818 · Other software · Espressif · reported by MITREMedium 6.8
An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.
- Product
- Esp32-d0wd-v3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordespressif.comespressif.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.