Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Feb 11, 2026Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels.CVE-2024-50619 · Other software · Cipplanner · reported by MITREHigh 8.8
Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privileged authenticated user can gain access to other people's accounts by tampering with the client's user id to change their account information. A low-privileged authenticated user can elevate his or her system privileges by modifying the information of a user role that is disabled in the client.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files.CVE-2024-50617 · Other software · Cipplanner · reported by MITREHigh 7.5
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17.CVE-2024-50620 · Other software · Cipplanner · reported by MITREHigh 8.8
Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17. An authorized user can upload executable files when inserting images in the rich text editor, and upload executable files when uploading files on the document management page. Those executables can be executed if they are not stored in a shared directory or if the storage directory has executed permissions.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcipplanner.comfacebook.com
Feb 11, 2026A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mecCVE-2024-50618 · Other software · Cipplanner · reported by MITREMedium 4.3
A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11587 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11586 · Other software · Cipplanner · reported by MITRECritical 9.8
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401.CVE-2020-11599 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11598 · Other software · Cipplanner · reported by MITRECritical 9.8
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11597 · Other software · Cipplanner · reported by MITRECritical 9.8
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11596 · Other software · Cipplanner · reported by MITREHigh 7.5
A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain information about what files and directories reside on the server.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11595 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11594 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11593 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11592 · Other software · Cipplanner · reported by MITREHigh 7.5
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11591 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11590 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11589 · Other software · Cipplanner · reported by MITREHigh 7.5
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Apr 6, 2020An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801.CVE-2020-11588 · Other software · Cipplanner · reported by MITREMedium 5.3
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and application paths.
- Product
- Cipace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.