Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 70 of 87
Jan 17, 2023A vulnerability was found in tynx wuersch and classified as critical.CVE-2015-10066 · Other software · tynx · reported by VulDBMedium 5.5
A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. The manipulation leads to sql injection. The patch is identified as 66d4718750a741d1053d327a79e285fd50372519. It is recommended to apply a patch to fix this issue. VDB-218462 is the identifier assigned to this vulnerability.
- Product
- wuersch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as problematic, was found in michaelliao jopenid.CVE-2010-10006 · Other software · michaelliao · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.
- Product
- jopenid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability classified as critical has been found in PrivateSky apersistence.CVE-2017-20171 · Other software · PrivateSky · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in PrivateSky apersistence. This affects an unknown part of the file db/sql/mysqlUtils.js. The manipulation leads to sql injection. The identifier of the patch is 954425f61634b556fe644837a592a5b8fcfca068. It is recommended to apply a patch to fix this issue. The identifier VDB-218457 was assigned to this vulnerability.
- Product
- apersistence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability classified as critical was found in AenBleidd FiND.CVE-2015-10065 · Other software · AenBleidd · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
- Product
- FiND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as critical, has been found in risheesh debutsav.CVE-2014-125081 · Other software · risheesh · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in risheesh debutsav. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 7a8430df79277c613449262201cc792db894fc76. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218459.
- Product
- debutsav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic.CVE-2022-4891 · Other software · Libsisimai · reported by VulDBLow 3.5
A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.
- Product
- Sisimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.comgithub.com
Jan 17, 2023A vulnerability was found in saemorris TheRadSystem and classified as critical.CVE-2015-10063 · Other software · saemorris · reported by VulDBHigh 7.3
A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file _login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is bfba26bd34af31648a11af35a0bb66f1948752a6. It is recommended to apply a patch to fix this issue. The identifier VDB-218453 was assigned to this vulnerability.
- Product
- TheRadSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0.CVE-2015-10062 · Other software · Galaxyproject · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The manipulation leads to injection. Upgrading to version 14.10.1 is able to address this issue. The patch is named 50d65f45d3f5be5d1fbff2e45ac5cec075f07d42. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218451.
- Product
- Galaxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability was found in MNBikeways database and classified as critical.CVE-2015-10060 · Other software · MNBikeways · reported by VulDBMedium 5.5
A vulnerability was found in MNBikeways database and classified as critical. This issue affects some unknown processing of the file Data/views.py. The manipulation of the argument id1/id2 leads to sql injection. The identifier of the patch is 829a027aca7c17f5a7ec1addca8dd5d5542f86ac. It is recommended to apply a patch to fix this issue. The identifier VDB-218417 was assigned to this vulnerability.
- Product
- database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability has been found in s134328 Webapplication-Veganguide and classified as problematic.CVE-2015-10059 · Other software · s134328 · reported by VulDBLow 3.5
A vulnerability has been found in s134328 Webapplication-Veganguide and classified as problematic. This vulnerability affects unknown code of the file p05-integration/app/shared/api/apiService.js. The manipulation of the argument country/city leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 2aa760fa4e779e40a28206a32ac22ac10356f519. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218416.
- Product
- Webapplication-Veganguide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as problematic, was found in Wikisource Category Browser.CVE-2015-10058 · Other software · Wikisource · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 764f4e8ce3f9242637df77530c70ae8a2ec4b6a1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218415.
- Product
- Category Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability was found in PictureThisWebServer and classified as critical.CVE-2015-10055 · Other software · Picturethiswebserver Project · reported by VulDBMedium 5.5
A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
- Product
- Picturethiswebserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, was found in githuis P2Manage.CVE-2015-10054 · Other software · githuis · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argument sql leads to sql injection. The identifier of the patch is 717380aba80002414f82d93c770035198b7858cc. It is recommended to apply a patch to fix this issue. The identifier VDB-218397 was assigned to this vulnerability.
- Product
- P2Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability has been found in frontaccounting faplanet and classified as critical.CVE-2014-125080 · Other software · frontaccounting · reported by VulDBMedium 5.5
A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.
- Product
- faplanet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp.CVE-2022-4890 · Other software · abhilash1985 · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.
- Product
- PredictApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability classified as critical was found in Events Extension on BigTree.CVE-2018-25076 · Other software · Events Project · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFeaturedEventByDate/getUpcomingFeaturedEventsInCategoriesWithSubcategories/recacheEvent/searchResults of the file classes/events.php. The manipulation leads to sql injection. The patch is named 11169e48ab1249109485fdb1e0c9fca3d25ba01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218395.
- Product
- Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3.CVE-2015-10053 · Other software · prodigasistemas · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
- Product
- curupira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability, which was classified as critical, was found in antonbolling clan7ups.CVE-2013-10012 · Other software · antonbolling · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c488291033958d845830ba0a1710764. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218388.
- Product
- clan7ups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical has been found in karsany OBridge up to 1.3.CVE-2018-25075 · Other software · karsany · reported by VulDBMedium 4.6
A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.
- Product
- OBridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151.CVE-2015-10052 · Other software · calesanz · reported by VulDBMedium 4.6
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipulation leads to open redirect. It is possible to initiate the attack remotely. The patch is named 88a517dc19443081210c804b655e72770727540d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218379. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- gibb-modul-151
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board.CVE-2015-10051 · Other software · bony2023 · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function display_all_replies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as 26439bc4c63632d63ba89ebc0f149b25a9010361. It is recommended to apply a patch to fix this issue. VDB-218378 is the identifier assigned to this vulnerability.
- Product
- Discussion-Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic.CVE-2015-10049 · Other software · Overdrive Eletrônica · reported by VulDBLow 3.5
A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is e39645fd714adb7e549908780235911ae282b21b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218372.
- Product
- course-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability has been found in lolfeedback and classified as critical.CVE-2015-10046 · Other software · Lolfeedback Project · reported by VulDBMedium 5.5
A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd37910051000f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.
- Product
- Lolfeedback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability, which was classified as critical, was found in tutrantta project_todolist.CVE-2015-10045 · Other software · tutrantta · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
- Product
- project_todolist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical was found in gophergala sqldump.CVE-2015-10044 · Other software · gophergala · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in gophergala sqldump. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 76db54e9073b5248b8863e71a63d66a32d567d21. It is recommended to apply a patch to fix this issue. VDB-218350 is the identifier assigned to this vulnerability.
- Product
- sqldump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability was found in yanheven console and classified as problematic.CVE-2014-125078 · Other software · yanheven · reported by VulDBLow 3.5
A vulnerability was found in yanheven console and classified as problematic. Affected by this issue is some unknown functionality of the file horizon/static/horizon/js/horizon.instances.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The patch is identified as 32a7b713468161282f2ea01d5e2faff980d924cd. It is recommended to apply a patch to fix this issue. VDB-218354 is the identifier assigned to this vulnerability.
- Product
- console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability, which was classified as critical, has been found in pointhi searx_stats.CVE-2014-125077 · Other software · pointhi · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.
- Product
- searx_stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability classified as critical was found in visegripped Stracker.CVE-2022-4889 · Other software · visegripped · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
- Product
- Stracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability, which was classified as critical, was found in abreen Apollo.CVE-2015-10043 · Other software · abreen · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to path traversal. The patch is named 6206406630780bbd074aff34f4683fb764faba71. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218307.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability has been found in ssn2013 cis450Project and classified as critical.CVE-2015-10020 · Other software · ssn2013 · reported by VulDBMedium 5.5
A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.
- Product
- cis450Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability, which was classified as problematic, was found in Minichan.CVE-2017-20167 · Other software · Minichan · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Minichan. This affects an unknown part of the file reports.php. The manipulation of the argument headline leads to cross site scripting. It is possible to initiate the attack remotely. The identifier of the patch is fc0e732e58630cba318d6bf49d1388a7aa9d390e. It is recommended to apply a patch to fix this issue. The identifier VDB-217785 was assigned to this vulnerability.
- Product
- Minichan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer.CVE-2017-20169 · Other software · GGGGGGGG · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.
- Product
- ToN-MasterServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle.CVE-2015-10042 · Other software · Dovgalyuk · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AIBattle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle.CVE-2015-10041 · Other software · Dovgalyuk · reported by VulDBMedium 5.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- AIBattle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in Th3-822 Rapidleech.CVE-2021-4312 · Other software · Th3-822 · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in Th3-822 Rapidleech. This affects the function zip_go of the file classes/options/zip.php. The manipulation of the argument archive leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 885a87ea4ee5e14fa95801eca255604fb2e138c6. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218295. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Rapidleech
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr.CVE-2009-10002 · Other software · dpup · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the file fittr-flickr/features/easy-exif.js of the component EXIF Preview Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 08875dd8a2e5d0d16568bb0d67cb4328062fccde. It is recommended to apply a patch to fix this issue. The identifier VDB-218297 was assigned to this vulnerability.
- Product
- fittr-flickr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2.CVE-2009-10001 · Other software · jianlinwei · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form.php. The manipulation of the argument captcha with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.3 is able to address this issue. The name of the patch is c84fb6b153bebaf228feee0cbf50728d27ae3f80. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218296.
- Product
- cool-php-captcha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability was found in aeharding classroom-engagement-system and classified as critical.CVE-2013-10011 · Other software · aeharding · reported by VulDBMedium 6.3
A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.
- Product
- classroom-engagement-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic.CVE-2012-10005 · Other software · manikandan170890 · reported by VulDBLow 3.5
A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
- Product
- php-form-builder-class
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comgithub.com
Jan 12, 2023A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101.CVE-2023-0246 · Other software · earclink · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.
- Product
- ESPCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical was found in TuziCMS 2.0.6.CVE-2023-0244 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical has been found in TuziCMS 2.0.6.CVE-2023-0243 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type coCVE-2023-23454 · Other software · Siemens · reported by MITREMedium 5.5
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Jan 11, 2023A vulnerability was found in gmail-servlet and classified as critical.CVE-2014-125075 · Other software · Gmail-servlet Project · reported by VulDBMedium 5.5
A vulnerability was found in gmail-servlet and classified as critical. This issue affects the function search of the file src/Model.java. The manipulation leads to sql injection. The identifier of the patch is 5d72753c2e95bb373aa86824939397dc25f679ea. It is recommended to apply a patch to fix this issue. The identifier VDB-218021 was assigned to this vulnerability.
- Product
- Gmail-servlet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical.CVE-2022-4885 · Other software · sviehb · reported by VulDBMedium 5
A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218020.
- Product
- jefferson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x.CVE-2020-36650 · Other software · IonicaBizau · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
- Product
- node-gry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability classified as problematic has been found in zerochplus.CVE-2013-10010 · Other software · Zerochplus Project · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in zerochplus. This affects the function PrintResList of the file test/mordor/thread.res.pl. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 9ddf9ecca8565341d8d26a3b2f64540bde4fa273. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218007.
- Product
- Zerochplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability was found in Prestaul skeemas and classified as problematic.CVE-2018-25074 · Other software · Prestaul · reported by VulDBLow 3.5
A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity. The patch is named 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218003.
- Product
- skeemas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic.CVE-2018-25073 · Other software · Newcomer1989 · reported by VulDBLow 3.5
A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.7 is able to address this issue. The patch is identified as b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77. It is recommended to upgrade the affected component. VDB-218002 is the identifier assigned to this vulnerability.
- Product
- TSN-Ranksystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A vulnerability, which was classified as critical, was found in ACI_Escola.CVE-2015-10037 · Other software · ACI Escola Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
- Product
- ACI Escola
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.