Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 78 of 87
Oct 17, 2022A vulnerability, which was classified as problematic, was found in X.org Server.CVE-2022-3553 · Other software · X.org · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orgsecurity.gentoo.org
Oct 17, 2022A vulnerability, which was classified as problematic, has been found in X.org Server.CVE-2022-3551 · Other software · X.org · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orglists.debian.org
Oct 17, 2022A vulnerability classified as critical was found in X.org Server.CVE-2022-3550 · Other software · X.org · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orglists.debian.org
Oct 17, 2022A vulnerability has been found in Linux Kernel and classified as critical.CVE-2022-3545 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.5
A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 17, 2022A vulnerability, which was classified as problematic, was found in Linux Kernel.CVE-2022-3544 · Computers, phones & browsers · Linux · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgvuldb.com
Oct 17, 2022A vulnerability, which was classified as problematic, has been found in Linux Kernel.CVE-2022-3543 · Computers, phones & browsers · Linux · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgvuldb.com
Oct 17, 2022A vulnerability classified as critical has been found in Linux Kernel.CVE-2022-3541 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgsecurity.netapp.com
Oct 16, 2022A vulnerability classified as problematic was found in Linux Kernel.CVE-2022-3526 · Computers, phones & browsers · Linux · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgvuldb.com
Oct 16, 2022A vulnerability has been found in Linux Kernel and classified as problematic.CVE-2022-3521 · Computers, phones & browsers · Linux · reported by VulDBLow 2.6
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Oct 12, 2022A vulnerability classified as critical was found in Jiusi OA.CVE-2022-3467 · Other software · Jiusi · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-210709 was assigned to this vulnerability.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022A vulnerability classified as critical was found in Mediabridge Medialink.CVE-2022-3465 · Other software · Mediabridge · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.
- Product
- Medialink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022A vulnerability classified as problematic has been found in puppyCMS up to 5.1.CVE-2022-3464 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-210699.
- Product
- puppyCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2022A vulnerability classified as problematic has been found in Linux Kernel.CVE-2022-3435 · Computers, phones & browsers · Linux · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Oct 6, 2022syslabs/sif is the Singularity Image Format (SIF) reference implementation.CVE-2022-39237 · Other software · sylabs · reported by GitHubMedium 6.3
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
- Product
- sif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic.CVE-2022-3354 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability.
- Product
- Open5GS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4.CVE-2022-3333 · Other software · Zephyr · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
- Product
- Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifyingCVE-2022-40144 · Other software · Trend Micro · reported by security@trendmicro.comCritical 9.8
A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappweb.trendmicro.comjvn.jp
Sep 16, 2022Classified Listing Pro: Does not escape a generated URL before outputting it back in an attribute in an admin pageCVE-2022-2655 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Classified Listing Pro
- Fixed in
- 2.0.20
- What to do
- Update Classified Listing Pro to 2.0.20 or newer.
Sep 16, 2022Classima: And some of its required plugins (Classified Listing before 2CVE-2022-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Classima
- Fixed in
- 2.1.11
- What to do
- Update Classima to 2.1.11 or newer.
Sep 14, 2022A vulnerability has been found in Nintendo Game Boy Color and classified as problematic.CVE-2022-3216 · Other software · Nintendo · reported by VulDBMedium 5
A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapter GB. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-208606 is the identifier assigned to this vulnerability.
- Product
- Game Boy Color
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comxcellerator.github.io
Sep 7, 2022A vulnerability classified as critical has been found in codeprojects Online Driving School.CVE-2022-3130 · Other software · codeprojects · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207873 was assigned to this vulnerability.
- Product
- Online Driving School
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2022A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System.CVE-2022-3015 · Other software · oretnom23 · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the file admin/?page=reports. The manipulation of the argument date leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-207425 was assigned to this vulnerability.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022A vulnerability classified as problematic has been found in ConsoleTVs Noxen.CVE-2022-2956 · Other software · ConsoleTVs · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><script>alert(/xss/)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207000.
- Product
- Noxen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022A vulnerability, which was classified as critical, was found in Laravel 5.1.CVE-2022-2886 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022A vulnerability was found in laravel 5.1 and classified as problematic.CVE-2022-2870 · Other software · unspecified · reported by VulDBMedium 4.1
A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.
- Product
- laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06.CVE-2022-2844 · Other software · MotoPress · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.
- Product
- Timetable and Event Schedule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022A vulnerability classified as critical has been found in SEMCMS.CVE-2022-2726 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in SEMCMS. This affects an unknown part of the file Ant_Check.php. The manipulation of the argument DID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205839.
- Product
- SEMCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2022A vulnerability, which was classified as problematic, was found in oretnom23 Fast Food Ordering System.CVE-2022-2686 · Other software · oretnom23 · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in oretnom23 Fast Food Ordering System. This affects an unknown part of the component Menu List Page. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205725 was assigned to this vulnerability.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022A vulnerability classified as critical has been found in Private Cloud Management Platform.CVE-2022-2664 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_management/global_config_query of the component POST Request Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. VDB-205614 is the identifier assigned to this vulnerability.
- Product
- Private Cloud Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0.CVE-2022-2591 · Other software · TEM · reported by VulDBHigh 7.5
A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FLEX-1085
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jul 25, 2022A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical.CVE-2017-20145 · Other software · Tecrail · reported by VulDBMedium 6.3
A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.11.0 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Responsive Filemanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2022A vulnerability has been found in Anvsoft PDFMate PDF Converter Pro 1.7.5.0 and classified as critical.CVE-2017-20144 · Other software · Anvsoft · reported by VulDBMedium 6.3
A vulnerability has been found in Anvsoft PDFMate PDF Converter Pro 1.7.5.0 and classified as critical. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- PDFMate PDF Converter Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comvulnerability-lab.com
Jul 22, 2022A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36.CVE-2017-20143 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36. This issue affects some unknown processing of the file /film-rating.php. The manipulation of the argument v leads to sql injection (Error). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Movie Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 22, 2022A vulnerability classified as critical was found in Itech Movie Portal Script 7.36.CVE-2017-20142 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Itech Movie Portal Script 7.36. This vulnerability affects unknown code of the file /artist-display.php. The manipulation of the argument act leads to sql injection (Union). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Movie Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 22, 2022A vulnerability classified as critical has been found in Itech Movie Portal Script 7.36.CVE-2017-20141 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Itech Movie Portal Script 7.36. This affects an unknown part of the file /movie.php. The manipulation of the argument f leads to sql injection (Union). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Movie Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 20, 2022A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical.CVE-2022-2488 · Other software · WAVLINK · reported by VulDBHigh 8
A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.
- Product
- WN535K2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical.CVE-2022-2487 · Other software · WAVLINK · reported by VulDBHigh 8
A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used.
- Product
- WN535K2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3.CVE-2022-2486 · Other software · WAVLINK · reported by VulDBHigh 8
A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used.
- Product
- WN535K2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic.CVE-2016-15003 · Other software · FileZilla · reported by VulDBMedium 6.3
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 17, 2022A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50.CVE-2015-10003 · Other software · FileZilla · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritygalore.comvuldb.com
Jul 16, 2022A vulnerability classified as critical has been found in Itech Classifieds Script 7.27.CVE-2017-20136 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Classifieds Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 16, 2022A vulnerability classified as critical was found in Itech Dating Script 3.26.CVE-2017-20135 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dating Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 16, 2022A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13.CVE-2017-20134 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Freelancer Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 16, 2022A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13.CVE-2017-20133 · Other software · Itech · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotely.
- Product
- Job Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2022A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical.CVE-2017-20132 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argument pl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Multi Vendor Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 13, 2022A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical.CVE-2017-20128 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- KB Messages PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 13, 2022A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical.CVE-2017-20127 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- KB Login Authentication Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jul 12, 2022A vulnerability was found in Online Hotel Booking System 1.0 and classified as critical.CVE-2022-2263 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability was found in Online Hotel Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit_room_cat.php of the component Room Handler. The manipulation of the argument roomname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Hotel Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022A vulnerability has been found in Online Hotel Booking System 1.0 and classified as critical.CVE-2022-2262 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability has been found in Online Hotel Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_all_room.php of the component Room Handler. The manipulation of the argument id with the input 2828%27%20AND%20(SELECT%203766%20FROM%20(SELECT(SLEEP(5)))BmIK)%20AND%20%27YLPl%27=%27YLPl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Hotel Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scrCVE-2022-33075 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.