Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Sep 23, 2026A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722.CVE-2026-96258 · Other software · onSite internet GmbH · reported by VulDBLow 2.1
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Auktion NG Auktionssoftware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2010SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector tCVE-2010-4614 · Other software · Mhproducts · reported by MITREHigh 7.5
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.
- Product
- ERO Auktion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
May 7, 2010SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk paramCVE-2010-1855 · Websites & servers · Phpscripte24 · reported by MITREHigh 7.5
SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
- Product
- PAY PER Watch & BID Auktions System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.comosvdb.org
May 7, 2010Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML viCVE-2010-1854 · Websites & servers · Phpscripte24 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the id_auk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this might be resultant from CVE-2010-1855.
- Product
- PAY PER Watch & BID Auktions System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Apr 6, 2010SQL injection vulnerability in auktion.php in Multi Auktions Komplett System 2 allows remote attackers to execute arbitrary SQL commands via the id_auk parameteCVE-2010-1270 · Websites & servers · Phpscripte24 · reported by MITREHigh 7.5
SQL injection vulnerability in auktion.php in Multi Auktions Komplett System 2 allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
- Product
- Multi Suktions Komplett System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.compacketstormsecurity.org
Apr 6, 2010SQL injection vulnerability in auktion.php in phpscripte24 Niedrig Gebote Pro Auktions System II allows remote attackers to execute arbitrary SQL commands via tCVE-2010-1269 · Websites & servers · Phpscripte24 · reported by MITREHigh 7.5
SQL injection vulnerability in auktion.php in phpscripte24 Niedrig Gebote Pro Auktions System II allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
- Product
- Niedrig Gebote Pro Auktions System II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.compacketstormsecurity.org
Mar 24, 2010SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-1094 · Other software · Miethner-scripting · reported by MITREHigh 7.5
SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- DZ Erotik Auktionshaus V4rgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.comosvdb.org
Mar 16, 2010SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the iCVE-2010-0973 · Other software · Scripteverkauf · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Domain Verkaus And Auktions Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.comsecunia.com
Feb 26, 2010SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-0723 · Other software · Mhproducts · reported by MITREHigh 7.5
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- ERO Auktion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.com4004securityproject.wordpress.com
Feb 26, 2010SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-0722 · Other software · Mhproducts · reported by MITREHigh 7.5
SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- PHP Auktion Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.comsecunia.com
Feb 26, 2010SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-0721 · Other software · Systemsoftware · reported by MITREHigh 7.5
SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Auktionshaus Gelb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Feb 26, 2010SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-0720 · Other software · Systemsoftware · reported by MITREHigh 7.5
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Erotik Auktionshaus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4004securityproject.wordpress.compacketstormsecurity.org
Jun 2, 2001Directory traversal vulnerability in HIS Auktion 1.62 allows remote attackers to read arbitrary files via a ..CVE-2001-0212 · Other software · HIS · reported by MITREHigh 7.5
Directory traversal vulnerability in HIS Auktion 1.62 allows remote attackers to read arbitrary files via a .. (dot dot) in the menue parameter, and possibly execute commands via shell metacharacters.
- Product
- Auktion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.