Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,307 results · page 79 of 87
Jun 30, 2022A vulnerability classified as critical was found in Online Hotel Booking System Pro 1.2.CVE-2017-20125 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Online Hotel Booking System Pro 1.2. Affected by this vulnerability is an unknown functionality of the file /roomtype-details.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Hotel Booking System Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 30, 2022A vulnerability classified as critical has been found in Online Hotel Booking System Pro Plugin 1.0.CVE-2017-20124 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Online Hotel Booking System Pro Plugin 1.0. Affected is an unknown function of the file /front/roomtype-details.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Hotel Booking System Pro Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 30, 2022A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015.CVE-2017-20122 · Other software · Bitrix · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the component Contact Form. The manipulation of the argument text with the input <img src="http://1"; on onerror="$(’p').text(’Hacked’)" /> leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Site Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability classified as problematic was found in TrueConf Server 4.3.7.CVE-2017-20120 · Other software · TrueConf · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 29, 2022A vulnerability classified as problematic has been found in TrueConf Server 4.3.7.CVE-2017-20119 · Other software · TrueConf · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 29, 2022A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic.CVE-2017-20115 · Other software · TrueConf · reported by VulDBLow 3.5
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 29, 2022A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic.CVE-2017-20114 · Other software · TrueConf · reported by VulDBLow 3.5
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 29, 2022A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7.CVE-2017-20113 · Other software · TrueConf · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 29, 2022A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical.CVE-2017-20112 · Other software · IVPN · reported by VulDBHigh 7.8
A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.6.2 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jun 29, 2022A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0.CVE-2017-20111 · Other software · Teleopti · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0.CVE-2017-20110 · Other software · Teleopti · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentials). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0.CVE-2017-20109 · Other software · Teleopti · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- WFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022A vulnerability classified as problematic has been found in Easy Table Plugin 1.6.CVE-2017-20108 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2022A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11.CVE-2017-20107 · Other software · ShadeYouVPN.com · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The manipulation leads to improper privilege management. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1.12 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1.CVE-2017-20106 · Other software · Lithium · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-side request forgery. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comvulnerability-lab.com
Jun 27, 2022A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8.CVE-2017-20103 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Kama Click Counter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical.CVE-2017-20099 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
- Product
- Analytics Stats Counter Statistics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A vulnerability was found in Album Lock 4.0 and classified as critical.CVE-2017-20102 · Other software · unspecified · reported by VulDBMedium 4.4
A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Album Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comvulnerability-lab.com
Jun 27, 2022A vulnerability, which was classified as problematic, was found in ProjectSend r754.CVE-2017-20101 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2022ESP-IDF is the official development framework for Espressif SoCs.CVE-2022-24893 · Other software · espressif · reported by GitHubHigh 7.5
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can result in memory corruption related attacks and potentially attacker gaining control of the entire system. Patch commits are available on the 4.1, 4.2, 4.3 and 4.4 branches and users are recommended to upgrade. The upgrade is applicable for all applications and users of `ESP-BLE-MESH` component from `ESP-IDF`. As it is implemented in the Bluetooth Mesh stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A vulnerability classified as problematic has been found in WP-SpamFree Anti-Spam Plugin 2.1.1.4.CVE-2017-20096 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in WP-SpamFree Anti-Spam Plugin 2.1.1.4. This affects an unknown part. The manipulation leads to basic cross site scripting. It is possible to initiate the attack remotely.
- Product
- WP-SpamFree Anti-Spam Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A vulnerability classified as critical was found in Simple Ads Manager Plugin.CVE-2017-20095 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely.
- Product
- Simple Ads Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4.CVE-2017-20094 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4. This issue affects some unknown processing. The manipulation leads to basic cross site scripting (Persistent). The attack may be initiated remotely. Upgrading to version 1.2.5 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- NewStatPress Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99.CVE-2017-20093 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely.
- Product
- Download Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1.CVE-2017-20092 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.
- Product
- Google Analytics Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability classified as problematic has been found in Atahualpa Theme.CVE-2017-20088 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Atahualpa Theme. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely.
- Product
- Atahualpa Theme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7.CVE-2017-20087 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.
- Product
- Alpine PhotoTile for Instagram Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4.CVE-2017-20086 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely.
- Product
- VaultPress Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A vulnerability has been found in Atahualpa Theme and classified as problematic.CVE-2017-20085 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.
- Product
- Atahualpa Theme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical.CVE-2017-20084 · Other software · JUNG · reported by VulDBMedium 5.3
A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart Visu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832.CVE-2017-20083 · Other software · JUNG · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart Visu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832.CVE-2017-20082 · Other software · JUNG · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown processing. The manipulation leads to backdoor. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart Visu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script.CVE-2017-20081 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script.CVE-2017-20080 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file /admin/googleads.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical was found in Hindu Matrimonial Script.CVE-2017-20079 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/photo.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical has been found in Hindu Matrimonial Script.CVE-2017-20078 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability was found in Hindu Matrimonial Script and classified as critical.CVE-2017-20074 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsletter1.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability has been found in Hindu Matrimonial Script and classified as critical.CVE-2017-20073 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cms.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script.CVE-2017-20072 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script.CVE-2017-20071 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/renewaldue.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical was found in Hindu Matrimonial Script.CVE-2017-20070 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 21, 2022A vulnerability classified as critical has been found in Hindu Matrimonial Script.CVE-2017-20069 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hindu Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 20, 2022A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic.CVE-2017-20066 · Other software · unspecified · reported by VulDBMedium 5.3
A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Adminer Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsumofpwn.nl
Jun 20, 2022A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic.CVE-2017-20065 · Other software · Supsystic · reported by VulDBMedium 4.3
A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Popup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgmap.httpcs.com
Jun 20, 2022A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic.CVE-2017-20062 · Other software · Elefant · reported by VulDBMedium 5
A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic.CVE-2017-20061 · Other software · Elefant · reported by VulDBMedium 4.3
A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC.CVE-2017-20060 · Other software · Elefant · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent). It is possible to initiate the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC.CVE-2017-20059 · Other software · Elefant · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input </title><img src=no onerror=alert(1)> leads to basic cross site scripting (Persistent). The attack may be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC.CVE-2017-20058 · Other software · Elefant · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent). The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC.CVE-2017-20057 · Other software · Elefant · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.