Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Dec 20, 2023SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table CVE-2023-47990 · Other software · Cuppacms · reported by MITRECritical 9.8
SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php.CVE-2023-39681 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrarCVE-2021-29368 · Other software · Cuppacms · reported by MITREHigh 8.8
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI.CVE-2022-37191 · Other software · Cuppacms · reported by MITREMedium 6.5
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE).CVE-2022-37190 · Other software · Cuppacms · reported by MITREHigh 8.8
CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.CVE-2022-38296 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups.CVE-2022-38295 · Other software · Cuppacms · reported by MITREMedium 6.1
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.CVE-2022-34121 · Other software · Cuppacms · reported by MITREHigh 7.5
Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.CVE-2022-27985 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcuppacms.com
Apr 26, 2022CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.CVE-2022-27984 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcuppacms.com
Mar 15, 2022CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.CVE-2022-25498 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.CVE-2022-25497 · Other software · Cuppacms · reported by MITREMedium 5.3
CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP CVE-2022-25495 · Other software · Cuppacms · reported by MITRECritical 9.8
The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.CVE-2022-25486 · Other software · Cuppacms · reported by MITREHigh 7.8
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.CVE-2022-25485 · Other software · Cuppacms · reported by MITREHigh 7.8
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary filesCVE-2022-25401 · Other software · Cuppacms · reported by MITREHigh 7.5
The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.CVE-2022-24647 · Other software · Cuppacms · reported by MITREHigh 8.1
Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter.CVE-2022-24266 · Other software · Cuppacms · reported by MITREHigh 7.5
Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter.CVE-2022-24265 · Other software · Cuppacms · reported by MITREHigh 7.5
Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.CVE-2022-24264 · Other software · Cuppacms · reported by MITREHigh 7.5
Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using thCVE-2021-3376 · Other software · Cuppacms · reported by MITREHigh 8.8
An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2020The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a customCVE-2020-26048 · Other software · Cuppacms · reported by MITREHigh 8.8
The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote arbitrary code execution.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.CVE-2018-19918 · Other software · Cuppacms · reported by MITREMedium 5.4
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2018CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.CVE-2018-19559 · Other software · Cuppacms · reported by MITRECritical 9.8
CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.CVE-2018-17300 · Other software · Cuppacms · reported by MITREMedium 4.8
Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.