Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 64 of 87
Jun 14, 2023A vulnerability classified as critical has been found in mccms up to 2.6.5.CVE-2023-3236 · Other software · Chshcms · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical.CVE-2023-3232 · Other software · Zhong Bang · reported by VulDBMedium 6.3
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_auth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231503. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic.CVE-2023-3231 · Other software · Ujcms · reported by VulDBLow 3.1
A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-231502 is the identifier assigned to this vulnerability.
- Product
- Ujcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3.CVE-2023-3208 · Other software · RoadFlow · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B73635494734D66B9C015CAC149EB05 of the component Login. The manipulation of the argument sidx/sord leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Visual Process Engine .NET Core Mvc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023A vulnerability classified as problematic was found in Chengdu VEC40G 3.0.CVE-2023-3206 · Other software · Chengdu · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- VEC40G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0.CVE-2015-10118 · Other software · cchetanonline · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtect_options_page of the file wp-copyprotect.php. The manipulation of the argument CopyProtect_nrc_text leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.1.0 is able to address this issue. The patch is identified as 8b8fe4102886b326330dc1ff06b17313fb10aee5. It is recommended to upgrade the affected component. VDB-231202 is the identifier assigned to this vulnerability.
- Product
- WP-CopyProtect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic.CVE-2023-3121 · Network & remote access · Dahua · reported by VulDBLow 3.5
A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Parking Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023A vulnerability classified as problematic was found in Arborator Server.CVE-2018-25087 · Other software · Arborator · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as cdbdbcbd491db65e9d697ab4365605fdfab1a604. It is recommended to apply a patch to fix this issue. VDB-230662 is the identifier assigned to this vulnerability.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress.CVE-2015-10117 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
- Product
- Gravity Forms DPS PxPay
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Gravity Forms DPS PxPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress.CVE-2015-10116 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
- Product
- RealFaviconGenerator Favicon
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update RealFaviconGenerator Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10030 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
- Product
- Exit Box Lite
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10029 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
- Product
- Exit Box Lite
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress.CVE-2015-10115 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
- Product
- WooSidebars Sidebar Manager Converter
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WooSidebars Sidebar Manager Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress.CVE-2015-10114 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
- Product
- WooSidebars
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WooSidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress.CVE-2015-10113 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
- Product
- WooFramework Tweaks
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WooFramework Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as critical, has been found in IBOS 4.5.5.CVE-2023-3100 · Other software · Ibos · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/approval/del. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-230690 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress.CVE-2015-10112 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic of the file wooframework-branding.php. The manipulation of the argument url leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is f12fccd7b5eaf66442346f748c901ef504742f78. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230652.
- Product
- WooFramework Branding
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WooFramework Branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS.CVE-2023-3099 · Other software · KylinSoft · reported by VulDBMedium 4.4
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230689 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS.CVE-2023-3098 · Other software · KylinSoft · reported by VulDBMedium 4.4
A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230688. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504.CVE-2023-3085 · Other software · X-WRT · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
- Product
- luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3.CVE-2016-15032 · Other software · mback2k · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['REMOTE_ADDR'] leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e25595593e8f19b9463. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- mh_httpbl Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress.CVE-2015-10110 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
- Product
- ruddernation TinyChat Room Spy
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update ruddernation TinyChat Room Spy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2023A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic.CVE-2023-3035 · Other software · Guangdong · reported by VulDBLow 3.5
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230467.
- Product
- Pythagorean OA Office System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic.CVE-2023-3029 · Other software · Guangdong · reported by VulDBMedium 4.3
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code of the file /note/index/delete. The manipulation of the argument id leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability.
- Product
- Pythagorean OA Office System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a.CVE-2010-10010 · Other software · Stars Alliance · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.2.2b is able to address this issue. The identifier of the patch is 5d3b7311fd5085ec6ea1b1bfa9a05285964e07e4. It is recommended to upgrade the affected component. The identifier VDB-230265 was assigned to this vulnerability.
- Product
- PsychoStats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsychostats.comgithub.com
May 31, 2023A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic.CVE-2015-10108 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 0.9.6.1 is able to address this issue. The patch is identified as 2a8057df8ca30adc859cecbe5cad21ac28c5b747. It is recommended to upgrade the affected component. VDB-230234 is the identifier assigned to this vulnerability.
- Product
- meitar Inline Google Spreadsheet Viewer
- Affected
- up to 0.9.6
- What to do
- Affects up to 0.9.6. Update meitar Inline Google Spreadsheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 31, 2023A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic.CVE-2023-3016 · Other software · yiwent · reported by VulDBLow 3.5
A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230360.
- Product
- Vip Video Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical.CVE-2023-3015 · Other software · yiwent · reported by VulDBMedium 6.3
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
- Product
- Vip Video Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6.CVE-2023-3014 · Other software · Beipyvideoresolution Project · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability.
- Product
- Beipyvideoresolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A vulnerability classified as critical has been found in ningzichun Student Management System 1.0.CVE-2023-3008 · Other software · ningzichun · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user/pass leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230355.
- Product
- Student Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic.CVE-2015-10107 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is d588446844dd49232ab400ef213ff5b92121c33e. It is recommended to upgrade the affected component. The identifier VDB-230153 was assigned to this vulnerability.
- Product
- Simplr Registration Form Plus+
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update Simplr Registration Form Plus+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0.CVE-2023-2981 · Other software · Abstrium · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0.CVE-2023-2980 · Other software · Abstrium · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0.CVE-2023-2979 · Other software · Abstrium · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1.CVE-2023-2970 · Other software · Mindspore · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2023A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress.CVE-2014-125102 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The identifier of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.
- Product
- Bestwebsoft Relevant
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Bestwebsoft Relevant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 28, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3.CVE-2015-10106 · Other software · mback2k · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is identified as 429f50f4e4795b20dae06735b41fb94f010722bf. It is recommended to upgrade the affected component. VDB-230086 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- mh_httpbl Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress.CVE-2014-125101 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The identifier of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.
- Product
- Portfolio Gallery
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2023A vulnerability was found in SeaCMS 11.6 and classified as problematic.CVE-2023-2926 · Other software · Seacms · reported by VulDBMedium 5.4
A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Picture Upload Handler. The manipulation of the argument oldpic leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230081 was assigned to this vulnerability.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4.CVE-2023-2925 · Other software · Webkul · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- krayin crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 27, 2023A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00.CVE-2023-2924 · Other software · Supcon · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SimField
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19.CVE-2023-2923 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function fromDhcpListClient. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511.CVE-2023-2903 · Other software · NFine · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Rapid Development Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100.CVE-2023-2888 · Websites & servers · Phpok · reported by VulDBMedium 4.7
A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-229953 was assigned to this vulnerability.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.CVE-2022-38716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 24, 2023A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443.CVE-2023-2875 · Other software · eScan · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 24, 2023A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8.CVE-2023-2874 · Other software · Twister · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x804f2154/0x804f2150/0x804f215c/0x804f2160/0x80800040/0x804f214c/0x804f2148/0x804f2144/0x801120e4/0x804f213c/0x804f2140 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-229853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 24, 2023A vulnerability classified as critical was found in Twister Antivirus 8.CVE-2023-2873 · Other software · Twister · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Twister Antivirus 8. This vulnerability affects the function 0x804f2143/0x804f217f/0x804f214b/0x80800043 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 24, 2023A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0.CVE-2023-2872 · Other software · Electronic · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229851. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flexihub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 24, 2023A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic.CVE-2023-2863 · Other software · Simple Design · reported by VulDBLow 2.3
A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229819.
- Product
- Daily Journal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.