Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 63 of 87
Jul 16, 2023A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic.CVE-2022-4952 · Other software · OmniSharp · reported by VulDBLow 3.5
A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability.
- Product
- csharp-language-server-protocol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16.CVE-2023-3691 · Other software · Layui · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
- Product
- Layui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7.CVE-2023-3690 · Other software · Bylancer · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- QuickOrder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7.CVE-2023-3689 · Other software · Bylancer · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7. Affected by this vulnerability is an unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234235. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- QuickQR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability classified as critical has been found in Bylancer QuickJob 6.1.CVE-2023-3688 · Other software · Bylancer · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Parameter Handler. The manipulation of the argument keywords/gender leads to sql injection. It is possible to launch the attack remotely. VDB-234234 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- QuickJob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic.CVE-2023-3684 · Other software · LivelyWorks · reported by VulDBLow 3.5
A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /change-language/de_DE of the component Base64 Encoding Handler. The manipulation of the argument redirectTo leads to open redirect. The attack may be launched remotely. VDB-234230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Articart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2023A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic.CVE-2023-3683 · Other software · LivelyWorks · reported by VulDBLow 3.5
A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Articart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2023A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0.CVE-2023-3682 · Other software · Nesote · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of the file /index.php/payment/getcoinaddress of the component POST Parameter Handler. The manipulation of the argument coinid leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234228. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Inout Blockchain EasyPayments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic.CVE-2023-3642 · Other software · GZ Scripts · reported by VulDBMedium 4.3
A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of the argument username/title/comment leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233888.
- Product
- Vacation Rental Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic.CVE-2023-3641 · Other software · khodakhah · reported by VulDBMedium 4.3
A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /en/blog-comment-4 of the component POST Request Handler. The manipulation of the argument comment_name/comment_content leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233887.
- Product
- NodCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 2023CVE-2023-3626 · Other software · Suncreate · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx of the component UpLoadFloodPlanFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233579. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mountain Flood Disaster Prevention Monitoring and Early Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706.CVE-2023-3625 · Other software · Suncreate · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx of the component Duty Write-UploadFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-233578 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mountain Flood Disaster Prevention Monitoring and Early Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023A vulnerability classified as critical has been found in Nesote Inout Blockchain FiatExchanger 3.0.CVE-2023-3624 · Other software · Nesote · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Nesote Inout Blockchain FiatExchanger 3.0. This affects an unknown part of the file /index.php/coins/update_marketboxslider of the component POST Parameter Handler. The manipulation of the argument marketcurrency leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-233577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Inout Blockchain FiatExchanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability was found in Dynacase Webdesk and classified as critical.CVE-2016-15034 · Other software · Dynacase · reported by VulDBMedium 5.5
A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-20180305 is able to address this issue. The patch is identified as 750a9b35af182950c952faf6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this vulnerability.
- Product
- Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8.CVE-2023-3579 · Other software · Hadsky · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8. Affected by this issue is some unknown functionality of the component User Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233372.
- Product
- Hadsky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability classified as critical was found in DedeCMS 5.7.109.CVE-2023-3578 · Other software · Dedecms · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic.CVE-2023-3563 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-233357 was assigned to this vulnerability.
- Product
- GZ E Learning Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic.CVE-2023-3562 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP CRM Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8.CVE-2023-3561 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP GZ Hotel Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8.CVE-2023-3560 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ticket Booking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8.CVE-2023-3559 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP GZ Appointment Scheduling Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8.CVE-2023-3558 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Event Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic.CVE-2023-3554 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GZ Forum Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic.CVE-2015-10121 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
- Product
- Beeliked Microsite
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Beeliked Microsite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress.CVE-2015-10120 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
- Product
- WDS Multisite Aggregate
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WDS Multisite Aggregate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress.CVE-2015-10119 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
- Product
- View All Posts Page
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update View All Posts Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2023A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic.CVE-2023-3542 · Other software · ThinuTech · reported by VulDBLow 3.5
A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.
- Product
- ThinuCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic.CVE-2023-3541 · Other software · ThinuTech · reported by VulDBLow 3.5
A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.
- Product
- ThinuCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4.CVE-2023-3540 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233292.
- Product
- NewsLetter Script PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7.CVE-2023-3539 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233291.
- Product
- Simple Forum PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0.CVE-2023-3538 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-233290 is the identifier assigned to this vulnerability.
- Product
- Photo Gallery PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4.CVE-2023-3537 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233289 was assigned to this vulnerability.
- Product
- News Script PHP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729.CVE-2023-3529 · Other software · Rotem Dynamics · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Rotem CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2023A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical.CVE-2023-3504 · Other software · SmartWeb Infotech · reported by VulDBMedium 6.3
A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /settings/account of the component My Profile Page. The manipulation of the argument filename leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-232952. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Job Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023A vulnerability classified as critical was found in IBOS OA 4.5.5.CVE-2023-3478 · Other software · IBOS · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023A vulnerability was found in SimplePHPscripts Event Script 2.1 and classified as problematic.CVE-2023-3475 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability was found in SimplePHPscripts Event Script 2.1 and classified as problematic. Affected by this issue is some unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. It is recommended to upgrade the affected component. VDB-232754 is the identifier assigned to this vulnerability.
- Product
- Event Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023A vulnerability has been found in SimplePHPscripts Simple Blog 3.2 and classified as problematic.CVE-2023-3474 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability has been found in SimplePHPscripts Simple Blog 3.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-232753 was assigned to this vulnerability.
- Product
- Simple Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8.CVE-2023-3465 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232711.
- Product
- Classified Ads Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsimplephpscripts.comvuldb.com
Jun 29, 2023A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8.CVE-2023-3464 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been classified as problematic. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation of the argument p leads to cross site scripting. It is possible to launch the attack remotely. It is recommended to upgrade the affected component. VDB-232710 is the identifier assigned to this vulnerability.
- Product
- Classified Ads Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsimplephpscripts.comvuldb.com
Jun 28, 2023A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical.CVE-2023-3450 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232547. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-BCR860
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023A vulnerability has been found in IBOS OA 4.5.5 and classified as critical.CVE-2023-3449 · Other software · IBOS · reported by VulDBMedium 5.5
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function actionExport of the file ?r=recruit/interview/export&interviews=x of the component Interview Management Export. The manipulation of the argument interviews leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-232546 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615.CVE-2023-3380 · Other software · Wavlink · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WN579X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2023A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0.CVE-2023-3311 · Other software · PuneethReddyHC · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807.
- Product
- online-shopping-system-advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkr1shna4garwal.github.iovuldb.com
Jun 18, 2023A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8.CVE-2023-3308 · Other software · whaleal · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231804.
- Product
- IceFrog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19.CVE-2023-3276 · Other software · Dromara · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HuTool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfbdhhhh47.github.iovuldb.com
Jun 14, 2023A vulnerability was found in OTCMS up to 6.62 and classified as problematic.CVE-2023-3241 · Other software · Otcms · reported by VulDBLow 3.5
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability has been found in OTCMS up to 6.62 and classified as problematic.CVE-2023-3240 · Other software · Otcms · reported by VulDBLow 3.5
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62.CVE-2023-3239 · Other software · Otcms · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62.CVE-2023-3238 · Other software · Otcms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability classified as critical was found in OTCMS up to 6.62.CVE-2023-3237 · Other software · Otcms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.