Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 67 of 87
Mar 25, 2023A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418.CVE-2023-1628 · Other software · Jianming · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418. Affected is an unknown function in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224010 is the identifier assigned to this vulnerability.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 25, 2023A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418.CVE-2023-1629 · Other software · JiangMin · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418. Affected by this vulnerability is the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224011.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 23, 2023A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic.CVE-2023-1613 · Other software · ruifang-tech · reported by VulDBLow 3.5
A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-223744.
- Product
- rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3.CVE-2023-1612 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223743.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3.CVE-2023-1610 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2 and classified as critical.CVE-2023-1606 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability has been found in novel-plus 3.6.2 and classified as critical.CVE-2023-1595 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, was found in novel-plus 3.6.2.CVE-2023-1594 · Other software · Xxyopen · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability was found in DataGear up to 1.11.1 and classified as problematic.CVE-2023-1573 · Other software · Datagear · reported by VulDBLow 3.5
A vulnerability was found in DataGear up to 1.11.1 and classified as problematic. This issue affects some unknown processing of the component Graph Dataset Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-223565 was assigned to this vulnerability.
- Product
- Datagear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0.CVE-2023-1571 · Other software · Datagear · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.
- Product
- Datagear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability, which was classified as problematic, has been found in syoyo tinydng.CVE-2023-1570 · Other software · syoyo · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.
- Product
- tinydng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic.CVE-2023-1572 · Other software · Datagear · reported by VulDBLow 2
A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.
- Product
- Datagear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability, which was classified as problematic, has been found in TinyTIFF 3.0.0.0.CVE-2023-1560 · Other software · Tinytiff Project · reported by VulDBLow 2.8
A vulnerability, which was classified as problematic, has been found in TinyTIFF 3.0.0.0. This issue affects some unknown processing of the file tinytiffreader.c of the component File Handler. The manipulation leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223553 was assigned to this vulnerability.
- Product
- Tinytiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0.CVE-2023-1558 · Other software · Simple And Beautiful Shopping Cart System Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223551.
- Product
- Simple And Beautiful Shopping Cart System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical.CVE-2018-25082 · Other software · zwczou · reported by VulDBMedium 6.3
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
- Product
- WeChat SDK Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic.CVE-2016-15029 · Other software · Ydalb · reported by VulDBLow 3.5
A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.10.0 is able to address this issue. The patch is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-223402 is the identifier assigned to this vulnerability.
- Product
- mapicoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6.CVE-2022-4933 · Other software · ATM Consulting · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability.
- Product
- dolibarr_module_quicksupplierprice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0.CVE-2015-10096 · Other software · Zarthus · reported by VulDBMedium 5
A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0. This affects the function get_tweets of the file lib/twitterbot/plugins/twitter_announcer.rb. The manipulation of the argument tweet leads to command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.1.1 is able to address this issue. The patch is named 6b1941b7fc2c70e1f40981b43c84a2c20cc12bd3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223383.
- Product
- IRC Twitter Announcer Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2023A vulnerability, which was classified as critical, was found in RockOA 2.3.2.CVE-2023-1501 · Other software · Rockoa · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223401 was assigned to this vulnerability.
- Product
- Rockoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability classified as critical was found in Rebuild up to 3.2.3.CVE-2023-1495 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Rebuild up to 3.2.3. Affected by this vulnerability is the function queryListOfConfig of the file /admin/robot/approval/list. The manipulation of the argument q leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c9474f84e5f376dd2ade2078e3039961a9425da7. It is recommended to apply a patch to fix this issue. The identifier VDB-223381 was assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability classified as critical has been found in IBOS 4.5.5.CVE-2023-1494 · Other software · Ibos · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in IBOS 4.5.5. Affected is an unknown function of the file ApiController.php. The manipulation of the argument emailids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223380.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical.CVE-2023-1490 · Other software · Max Secure · reported by VulDBMedium 4.4
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223376.
- Product
- Anti Virus Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical.CVE-2023-1489 · Other software · Lespeed · reported by VulDBHigh 7.8
A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223375.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability, which was classified as problematic, was found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54.CVE-2023-1488 · Other software · Lespeed · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, was found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54. Affected is the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-223374 is the identifier assigned to this vulnerability.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability, which was classified as problematic, has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54.CVE-2023-1487 · Other software · Lespeed · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54. This issue affects the function 0x9C40208C/0x9C402000/0x9C402084/0x9C402088/0x9C402004/0x9C4060C4/0x9C4060CC/0x9C4060D0/0x9C4060D4/0x9C40A0DC/0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223373 was assigned to this vulnerability.
- Product
- WiseCleaner Wise System Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54.CVE-2023-1486 · Other software · Lespeed · reported by VulDBMedium 4.4
A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223372.
- Product
- WiseCleaner Wise Force Deleter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 18, 2023A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical.CVE-2023-1484 · Other software · xzjie · reported by VulDBMedium 6.3
A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-223367.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical.CVE-2023-1483 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability, which was classified as problematic, was found in HkCms 2.2.4.230206.CVE-2023-1482 · Other software · Hkcms Project · reported by VulDBMedium 4.7
A vulnerability, which was classified as problematic, was found in HkCms 2.2.4.230206. This affects an unknown part of the file /admin.php/appcenter/local.html?type=addon of the component External Plugin Handler. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223365 was assigned to this vulnerability.
- Product
- Hkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability classified as critical has been found in jeecg-boot 3.5.0.CVE-2023-1454 · Other software · Jeecg · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability was found in MP4v2 2.1.2 and classified as problematic.CVE-2023-1450 · Other software · Mp4v2 Project · reported by VulDBLow 3.3
A vulnerability was found in MP4v2 2.1.2 and classified as problematic. This issue affects the function DumpTrack of the file mp4trackdump.cpp. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223295.
- Product
- Mp4v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic.CVE-2023-1449 · Other software · Gpac · reported by VulDBMedium 5.3
A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master.CVE-2023-1448 · Other software · Gpac · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gf_m2ts_process_sdt of the file media_tools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223293 was assigned to this vulnerability.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0.CVE-2023-1446 · Other software · Watchdog · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0. Affected by this vulnerability is the function 0x80002004/0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223291.
- Product
- Anti-Virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 17, 2023A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8.CVE-2023-1445 · Other software · Filseclab · reported by VulDBLow 3.3
A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8. Affected is the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-223290 is the identifier assigned to this vulnerability.
- Product
- Twister Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 15, 2023A vulnerability classified as critical has been found in Simple Art Gallery 1.0.CVE-2023-1416 · Other software · Code-projects · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.
- Product
- Simple ART Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0.CVE-2023-1398 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2023A vulnerability, which was classified as problematic, has been found in Hsycms 3.1.CVE-2023-1349 · Other software · Hsycms · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller\cate.php of the component Add Category Module. The manipulation of the argument title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222842 is the identifier assigned to this vulnerability.
- Product
- Hsycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023A vulnerability was found in lmxcms 1.41 and classified as critical.CVE-2023-1322 · Other software · Lmxcms · reported by VulDBMedium 6.3
A vulnerability was found in lmxcms 1.41 and classified as critical. Affected by this issue is the function reply of the file BookAction.class.php. The manipulation of the argument id with the input 1) and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222728.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023A vulnerability has been found in lmxcms 1.41 and classified as critical.CVE-2023-1321 · Other software · Lmxcms · reported by VulDBMedium 6.3
A vulnerability has been found in lmxcms 1.41 and classified as critical. Affected by this vulnerability is the function update of the file AcquisiAction.class.php. The manipulation of the argument id with the input -1 and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222727.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic.CVE-2017-20182 · Other software · Mobile Vikings · reported by VulDBLow 3.5
A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The patch is named 329eb1dd1580ca1f9d4f95bc69939833226515c9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222611.
- Product
- Django AJAX Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic.CVE-2014-125093 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 1.2.2 is able to address this issue. The patch is identified as 3312b9cd79e5710d1e282fc9216a4e5ab31b3d94. It is recommended to upgrade the affected component. VDB-222610 is the identifier assigned to this vulnerability.
- Product
- Ad Blocking Detector
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Ad Blocking Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2023A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress.CVE-2013-10020 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress. This affects an unknown part of the file a-forms.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The identifier of the patch is 3e693197bd69b7173cc16d8d2e0a7d501a2a0b06. It is recommended to upgrade the affected component. The identifier VDB-222609 was assigned to this vulnerability.
- Product
- MMDeveloper A Forms
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update MMDeveloper A Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2023A vulnerability was found in UCMS 1.6 and classified as critical.CVE-2023-1303 · Other software · Ucms Project · reported by VulDBMedium 6.3
A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component System File Management Module. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-222683.
- Product
- Ucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5.CVE-2023-1278 · Other software · Ibos · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionality of the file mobil/index.php. The manipulation of the argument accesstoken leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-222608.
- Product
- Ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin.CVE-2023-1277 · Other software · Ubuntukylin · reported by VulDBHigh 7.8
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.
- Product
- Kylin-system-updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as critical, has been found in SUL1SS_shop.CVE-2023-1276 · Other software · Sul1ss Shop Project · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.
- Product
- Sul1ss Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtib36.github.iovuldb.com
Mar 7, 2023A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows.CVE-2023-1003 · Other software · Typora · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.8 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221736.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic.CVE-2015-10087 · WordPress plugins & themes · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 53f6ae62878076f99718e5feb589928e83c879a9. It is recommended to apply a patch to fix this issue. The identifier VDB-221809 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comsupport.alertlogic.com
Mar 6, 2023A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android.CVE-2017-20181 · Other software · hgzojer · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android. This vulnerability affects unknown code of the file src/at/hgz/vocabletrainer/VocableTrainerProvider.java. The manipulation leads to path traversal. Attacking locally is a requirement. Upgrading to version 1.3.1 is able to address this issue. The name of the patch is accf6838078f8eb105cfc7865aba5c705fb68426. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222328.
- Product
- Vocable Trainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.