Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

6,265 results · page 77 of 126

Jan 25, 2018Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearingCVE-2017-1000391 · Websites & servers · Jenkins · reported by MITREHigh 7.3
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jenkins.io
Jan 24, 2018GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron appCVE-2018-1000006 · Other software · Atom · reported by MITREHigh 8.8
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.
Product
Electron
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com electronjs.org
Jan 24, 2018SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= request.CVE-2018-5977 · Other software · Getaffiligator · reported by MITRECritical 9.8
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= request.
Product
Affiligator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 23, 2018Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1.CVE-2017-2746 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6.1
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerabilities could potentially be exploited to allow stored cross-site scripting which could allow a hacker to create a denial of service.
Product
HP JetAdvantage Security Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jan 23, 2018Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1.CVE-2017-2745 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6.1
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerabilities could potentially be exploited to allow stored cross-site scripting which could allow a hacker to execute scripts in a user's browser.
Product
HP JetAdvantage Security Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jan 23, 2018A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2.CVE-2017-2742 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could potentially be exploited to create a denial of service.
Product
HP Web Jetadmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com support.hp.com
Jan 19, 2018Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files oCVE-2017-15713 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Product
Apache Hadoop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Jan 17, 2018Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Cross Pillar).CVE-2018-2730 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.4
Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Cross Pillar). The supported version that is affected is 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Merchandising System. While the vulnerability is in Oracle Retail Merchandising System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Merchandising System accessible data as well as unauthorized read access to a subset of Oracle Retail Merchandising System accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Product
Retail Merchandising System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Jan 16, 2018Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script CVE-2017-8802 · Other software · Synocor · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.zimbra.com
Jan 12, 2018In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small.CVE-2017-13210 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67782345.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 11, 2018Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.CVE-2018-5327 · Other software · Cmcm · reported by MITREHigh 7.5
Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
Product
Armorfly Browser & Downloader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twitter.com twitter.com
Jan 11, 2018Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.CVE-2018-5326 · Other software · Cmcm · reported by MITREHigh 7.5
Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
Product
CM Browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twitter.com twitter.com
Jan 8, 2018cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, CVE-2017-18025 · Other software · Innotube · reported by MITRECritical 9.8
cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter.
Product
Itguard Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 5, 2018Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file.CVE-2017-16666 · Other software · Xplico · reported by MITREHigh 8.8
Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature.
Product
Xplico
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.securityonion.net packetstormsecurity.com
Jan 3, 2018The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via CVE-2018-4868 · Other software · Exiv2 · reported by MITREMedium 5.5
The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file.
Product
Exiv2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 2, 2018Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of servicCVE-2017-1000463 · Other software · Leafpub · reported by MITREMedium 5.4
Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code.
Product
Leafpub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 31, 2017Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.CVE-2017-18005 · Other software · Exiv2 · reported by MITREMedium 5.5
Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.
Product
Exiv2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.CVE-2017-17987 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
Product
Muslim Matrimonial Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2017In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests.CVE-2017-6139 · Network & remote access · F5 Networks, Inc. · reported by f5sirt@f5.comMedium 5.9
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk.
Product
BIG-IP APM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Dec 21, 2017A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 andCVE-2017-17033 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS Notification function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 andCVE-2017-17032 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS Password function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 andCVE-2017-17031 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS Password function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and eaCVE-2017-17030 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS Login function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and eaCVE-2017-17029 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS Login function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171CVE-2017-17028 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS External Device function
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 21, 2017A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earliCVE-2017-17027 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Product
QTS FTP service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com qnap.com
Dec 19, 2017TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcCVE-2017-17758 · Network & remote access · Tp-link · reported by MITREHigh 8.8
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd.
Product
Tl-wvr450l Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 19, 2017TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wpoCVE-2017-17757 · Network & remote access · Tp-link · reported by MITREHigh 8.8
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd.
Product
Tl-wvr450l Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2017NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoSCVE-2017-14583 · Other software · Netapp · reported by MITREMedium 6.5
NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in SMB environments.
Product
Clustered Data Ontap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com security.netapp.com
Dec 18, 2017Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.CVE-2017-17649 · Other software · Readymade Video Sharing Script Project · reported by MITREMedium 6.1
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
Product
Readymade Video Sharing Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.CVE-2017-17636 · Other software · MLM Forced Matrix Project · reported by MITRECritical 9.8
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
Product
MLM Forced Matrix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.CVE-2017-17635 · Other software · MLM Forex Market Plan Script Project · reported by MITRECritical 9.8
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
Product
MLM Forex Market Plan Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid CVE-2017-17633 · Other software · Multiplex Movie Theater Booking Script Project · reported by MITRECritical 9.8
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.
Product
Multiplex Movie Theater Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.CVE-2017-17629 · Websites & servers · Secure E-commerce Script Project · reported by MITRECritical 9.8
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.
Product
Secure E-commerce Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.CVE-2017-17627 · Other software · Readymade Video Sharing Script Project · reported by MITRECritical 9.8
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
Product
Readymade Video Sharing Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.CVE-2017-17624 · Websites & servers · PHP Multivendor Ecommerce Project · reported by MITRECritical 9.8
PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.
Product
PHP Multivendor Ecommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.CVE-2017-17621 · Other software · Multivendor Penny Auction Clone Script Project · reported by MITRECritical 9.8
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
Product
Multivendor Penny Auction Clone Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 13, 2017Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter.CVE-2017-17613 · Other software · Freelance Website Script Project · reported by MITRECritical 9.8
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter.
Product
Freelance Website Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.CVE-2017-17610 · Websites & servers · E-commerce MLM Software Project · reported by MITRECritical 9.8
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.
Product
E-commerce MLM Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.CVE-2017-17607 · Other software · CMS Auditor Website Project · reported by MITRECritical 9.8
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
Product
CMS Auditor Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.CVE-2017-17604 · Other software · Entrepreneur BUS Booking Script Project · reported by MITRECritical 9.8
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
Product
Entrepreneur BUS Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.CVE-2017-17602 · Other software · Advance B2b Script Project · reported by MITRECritical 9.8
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
Product
Advance B2b Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.CVE-2017-17600 · Other software · Basic B2b Script Project · reported by MITRECritical 9.8
Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
Product
Basic B2b Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.CVE-2017-17587 · Other software · Indiamart Clone Project · reported by MITRECritical 9.8
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.
Product
Indiamart Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.CVE-2017-17585 · Other software · Monster Clone Project · reported by MITRECritical 9.8
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
Product
Monster Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.CVE-2017-17580 · Other software · Linkedin Clone Project · reported by MITRECritical 9.8
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.
Product
Linkedin Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.CVE-2017-17578 · Other software · Crowdfunding Script Project · reported by MITRECritical 9.8
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
Product
Crowdfunding Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.CVE-2017-17577 · Other software · Trademe Clone Project · reported by MITRECritical 9.8
FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.
Product
Trademe Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.CVE-2017-17575 · Other software · Groupon Clone Project · reported by MITRECritical 9.8
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
Product
Groupon Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 11, 2017Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request.CVE-2017-17111 · Other software · Scubez · reported by MITRECritical 9.8
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request.
Product
Posty Readymade Classifieds
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.