Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
99 results · page 1 of 2
Aug 10, 2026entr is vulnerable to Heap-based buffer overflow in run_utility() function.CVE-2026-18370 · Other software · eradman · reported by cvd@cert.plMedium 4.8
entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service. This issue was fixed in commit 2467fe0
- Product
- entr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_dCVE-2026-18933 · WordPress plugins & themes · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.
- What to do
- Update the plugin to the newest version.
May 16, 2026Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by suCVE-2020-37234 · Other software · Internetdownloadmanager · reported by VulnCheckMedium 6.9
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.
- Product
- Internet Download Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinternetdownloadmanager.cominternetdownloadmanager.com
Feb 18, 2026WP-DownloadManager: Path TraversalCVE-2026-2426 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.
- Product
- WP-DownloadManager
- Affected
- up to 1.69
- What to do
- Affects up to 1.69. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 18, 2026WP-DownloadManager: Path TraversalCVE-2026-2419 · WordPress plugins & themes · reported by WordfenceLow 2.7
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration parameter. This is due to insufficient validation of the download path setting, which allows directory traversal sequences to bypass the WP_CONTENT_DIR prefix check. This makes it possible for authenticated attackers, with Administrator-level access and above, to configure the plugin to list and access arbitrary files on the server by exploiting the file browser functionality.
- Product
- WP-DownloadManager
- Affected
- up to 1.69
- What to do
- Affects up to 1.69. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 13, 2026Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management moduleCVE-2025-9435 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.5
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
- Product
- ManageEngine ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.CVE-2025-11670 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.4
Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
- Product
- ManageEngine ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.CVE-2025-10020 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.5
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
- Product
- ManageEngine ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025WP-DownloadManager: Arbitrary file uploadsCVE-2025-10747 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP-DownloadManager
- Affected
- up to 1.68.11
- What to do
- Affects up to 1.68.11. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2025WP-DownloadManager: Arbitrary file deletionCVE-2025-4799 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory.
- Product
- WP-DownloadManager
- Affected
- up to 1.68.10
- What to do
- Affects up to 1.68.10. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2025WP-DownloadManager: Arbitrary file readCVE-2025-4798 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files.
- Product
- WP-DownloadManager
- Affected
- up to 1.68.10
- What to do
- Affects up to 1.68.10. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2025The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-48207 · Other software · TYPO3 · reported by MITREHigh 8.6
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
- Product
- reint downloadmanager extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification.CVE-2024-11696 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 20, 2024In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.CVE-2018-9468 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.1
In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Hacklog DownloadManager: Cross-Site Request Forgery (CSRF)CVE-2024-52401 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through <= 2.1.4.
- Product
- Hacklog DownloadManager
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Hacklog DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.CVE-2024-24409 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.
- Product
- ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.CVE-2024-48878 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.
- Product
- ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024WP-DownloadManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-DownloadManager wp-downloadmanager allows Reflected XSS.This issue affects WP-DownloadManager: from n/a through <= 1.68.8.
- Product
- WP-DownloadManager
- Affected
- up to 1.68.8
- What to do
- Affects up to 1.68.8. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2023In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECCVE-2022-39820 · Other software · Nokia · reported by MITREMedium 6.5
In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.
- Product
- Network Functions Manager For Transport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.CVE-2023-27441 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 27, 2023Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.CVE-2023-41904 · Email & office · Zohocorp · reported by MITREMedium 5.4
Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 11, 2023Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.CVE-2023-38743 · Email & office · Zohocorp · reported by MITREHigh 7.2
Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 31, 2023Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.CVE-2023-39912 · Email & office · Zohocorp · reported by MITREMedium 4.9
Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 28, 2023Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xCVE-2023-35785 · Email & office · Zohocorp · reported by MITREHigh 8.1
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Reporter Plus 5709 and below, Log360 5315 and below, Log360 UEBA 4045 and below, M365 Manager Plus 4529 and below, M365 Security Plus 4529 and below, Recovery Manager Plus 6061 and below, ServiceDesk Plus 14204 and below and 143xx 14302 and below, ServiceDesk Plus MSP 14300 and below, SharePoint Manager Plus 4402 and below, and Support Center Plus 14300 and below are vulnerable to 2FA bypass via a few TOTP authenticators. Note: A valid pair of username and password is required to leverage this vulnerability.
- Product
- Manageengine Ad360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 17, 2023Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticatedCVE-2023-31492 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 4, 2023Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.CVE-2023-38332 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 5, 2023Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.CVE-2023-35786 · Email & office · Zohocorp · reported by MITREMedium 4.9
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 13, 2023Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.CVE-2023-29084 · Email & office · Zohocorp · reported by MITREHigh 7.2
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commanageengine.com
Nov 18, 2022Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.CVE-2022-42904 · Email & office · Zohocorp · reported by MITREHigh 7.2
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 18, 2022Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certaiCVE-2022-29457 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
- Product
- Manageengine Adaudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.unsafe-inline.com
Mar 25, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
- Affected
- up to 1.68.6
- What to do
- Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
- Affected
- up to 1.68.6
- What to do
- Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 11, 2021Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.CVE-2021-42002 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 13, 2021ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PersonCVE-2021-20131 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 8.8
ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 13, 2021ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswoCVE-2021-20130 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 8.8
ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 7, 2021Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.CVE-2021-38298 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37931 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37930 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37929 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37928 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37926 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37924 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37923 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another.CVE-2021-37922 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37921 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37920 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37919 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.CVE-2021-37918 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 7, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.CVE-2021-37762 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 6, 2021Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket.CVE-2021-25485 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.