Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,139 results · page 9 of 23
May 10, 2025WordPress Review Plugin: The Ultimate Solution for Building a Review Website: Local File InclusionCVE-2025-2158 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register_argc_argv also enabled.
- Product
- WordPress Review Plugin: The Ultimate Solution for Building a Review Website
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update WordPress Review Plugin: The Ultimate Solution for Building a Review Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 9, 2025Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external websiteCVE-2025-29509 · Other software · reported by MITREHigh 8.8
Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal().
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.github.com
May 9, 2025Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode: Unauthorized access of dataCVE-2025-3949 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.
- Product
- Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
- Affected
- up to 6.18.15
- What to do
- Affects up to 6.18.15. Update Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 8, 2025Improper access control in Azure allows an unauthorized attacker to disclose information over a network.CVE-2025-33072 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft msagsfeedback.azurewebsites.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into tCVE-2025-3859 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
- Product
- Focus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 27, 2025A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic.CVE-2025-3975 · Websites & servers · ScriptAndTools · reported by VulDBMedium 6.9
A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- eCommerce-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
- Affected
- up to 5.10.29
- What to do
- Affects up to 5.10.29. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 25, 2025Halo is an open source website building tool.CVE-2024-56156 · Other software · halo-dev · reported by GitHubMedium 5.5
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46254 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.10.0.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.10.0
- What to do
- Affects up to 45.10.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
- Affected
- up to 5.10.28
- What to do
- Affects up to 5.10.28. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-32389 · Other software · NamelessMC · reported by GitHubHigh 8.6
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a¶m[1]=b¶m[2]=c` utilized by PHP, which is parsed by PHP as `$_GET['param']` being of type array. This issue has been patched in version 2.1.4.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-31120 · Other software · NamelessMC · reported by GitHubMedium 5.3
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session variable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics. This issue has been patched in version 2.2.0.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-31118 · Other software · NamelessMC · reported by GitHubHigh 7.1
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction, resulting in an uncontrolled surge of posts that can disrupt normal operations. This issue has been patched in version 2.2.0.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-30357 · Other software · NamelessMC · reported by GitHubHigh 7.3
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator deletes the malicious user's account, all their posts (comments) along with the associated topics (by unrelated users) will be marked as deleted. This issue has been patched in version 2.2.0.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-30158 · Other software · NamelessMC · reported by GitHubHigh 7.1
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025NamelessMC is a free, easy to use & powerful website software for Minecraft servers.CVE-2025-29784 · Other software · NamelessMC · reported by GitHubHigh 7.5
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and potential denial-of-service (DoS) attacks. This issue has been patched in version 2.2.0.
- Product
- Nameless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Web-Check is an all-in-one OSINT tool for analyzing any website.CVE-2025-32778 · Other software · Lissy93 · reported by GitHubCritical 9.3
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
- Product
- web-check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker toCVE-2025-29280 · Other software · Perfree · reported by MITREMedium 4.8
Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.
- Product
- Perfreeblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0.CVE-2025-3557 · Websites & servers · ScriptAndTools · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eCommerce-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0.CVE-2025-3556 · Websites & servers · ScriptAndTools · reported by VulDBMedium 6.3
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eCommerce-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0.CVE-2025-3555 · Websites & servers · ScriptAndTools · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eCommerce-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability was found in Tutorials-Website Employee Management System 1.0.CVE-2025-3537 · Other software · Tutorials-Website · reported by VulDBMedium 6.9
A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical.CVE-2025-3536 · Other software · Tutorials-Website · reported by VulDBMedium 6.9
A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.CVE-2025-32413 · Other software · CIRCL · reported by MITREMedium 6.4
Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.
- Product
- Vulnerability-Lookup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately validated before being proCVE-2025-29594 · Other software · reported by MITREMedium 6.1
A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately validated before being processed. Specifically, the $_GET['errorcode'] parameter can be manipulated to access unauthorized error codes, leading to Cross-Site Scripting (XSS) attacks and information disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Simple Website Logo: Missing AuthorizationCVE-2025-32258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in InfoGiants Simple Website Logo simple-website-logo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Website Logo: from n/a through <= 1.1.
- Product
- Simple Website Logo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Website Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WP Genealogy – Your Family History Website: Missing AuthorizationCVE-2025-32252 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Black and White WP Genealogy – Your Family History Website wpgenealogy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Genealogy – Your Family History Website: from n/a through <= 0.1.9.
- Product
- WP Genealogy – Your Family History Website
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update WP Genealogy – Your Family History Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025onOffice for WP-Websites: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32127 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows SQL Injection.This issue affects onOffice for WP-Websites: from n/a through <= 5.7.
- Product
- onOffice for WP-Websites
- Affected
- up to 5.7
- What to do
- Affects up to 5.7. Update onOffice for WP-Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website: Stored Cross-Site ScriptingCVE-2024-13898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Feedbucket – Website Feedback Tool: Cross-Site Request Forgery (CSRF)CVE-2025-31859 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Feedbucket Feedbucket – Website Feedback Tool feedbucket allows Cross Site Request Forgery.This issue affects Feedbucket – Website Feedback Tool: from n/a through <= 1.0.6.
- Product
- Feedbucket – Website Feedback Tool
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Feedbucket – Website Feedback Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025scratch-coding-hut.github.io is the website for Coding Hut.CVE-2025-31122 · Other software · Scratch-Coding-Hut · reported by GitHubCritical 9
scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.
- Product
- Scratch-Coding-Hut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Emlog is an open source website building system.CVE-2025-30372 · Other software · emlog · reported by GitHubHigh 7.7
Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is CVE-2025-2864 · Other software · Arteche · reported by cve-coordination@incibe.esLow 2
SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025JiangQie Official Website Mini Program: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30604 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program jiangqie-official-website-mini-program allows Blind SQL Injection.This issue affects JiangQie Official Website Mini Program: from n/a through <= 1.8.2.
- Product
- JiangQie Official Website Mini Program
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update JiangQie Official Website Mini Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites CVE-2024-9308 · Other software · haotian-liu · reported by security@huntr.devMedium 6.1
An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
- Product
- haotian-liu/llava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITECVE-2024-8952 · Other software · composiohq · reported by security@huntr.devHigh 7.5
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.
- Product
- composiohq/composio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specialCVE-2024-10908 · Other software · lm-sys · reported by security@huntr.devMedium 6.1
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
- Product
- lm-sys/fastchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web scripts or HTML via aCVE-2024-55060 · Other software · Rafed-system · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Rafed CMS Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrafed-system.org
Mar 13, 2025Page Builder: Pagelayer – Drag and Drop website builder: Unauthorized post publicationCVE-2025-2104 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.
- Product
- Page Builder: Pagelayer – Drag and Drop website builder
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 12, 2025Page Builder: Pagelayer – Drag and Drop website builder: Information ExposureCVE-2024-13430 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
- Product
- Page Builder: Pagelayer – Drag and Drop website builder
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 11, 2025In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after thCVE-2024-51321 · Other software · Zucchetti · reported by MITREHigh 7.6
In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Page Builder: Pagelayer – Drag and Drop website builder: Cross-Site Request ForgeryCVE-2025-1926 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Page Builder: Pagelayer – Drag and Drop website builder
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 6, 2025A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0.CVE-2025-2041 · Websites & servers · s-a-zhd · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functionality of the file /shop.php. The manipulation of the argument p_cat leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ecommerce-Website-using-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0.CVE-2025-2036 · Websites & servers · s-a-zhd · reported by VulDBMedium 5.3
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php. The manipulation of the argument pro_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ecommerce-Website-using-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical.CVE-2025-2035 · Websites & servers · s-a-zhd · reported by VulDBMedium 5.3
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /customer_register.php. The manipulation of the argument name leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ecommerce-Website-using-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL InjectioCVE-2024-9149 · Websites & servers · Wind Media · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5.
- Product
- E-Commerce Website Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 4, 2025Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL.CVE-2025-27426 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox for iOS 136.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 4, 2025Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first.CVE-2025-27425 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 4, 2025Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page.CVE-2025-27424 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS 136.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 3, 2025A vulnerability was found in Codezips Online Shopping Website 1.0.CVE-2025-1903 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Shopping Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.