Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

91 results · page 1 of 2

Sep 24, 2026Improper Access Control in DIAEnergie.CVE-2026-78313 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 6.5
Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Sep 24, 2026Path Traversal in DIAEnergie.CVE-2026-78312 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.1
Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Sep 24, 2026SQL Injection vulnerability in DIAEnergie.CVE-2026-78311 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Sep 24, 2026Authorization Bypass Through User-Controlled Key in DIAEnergie.CVE-2026-78310 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 4.3
Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Sep 24, 2026SQL Injection vulnerability in DIAEnergie.CVE-2026-78309 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com pellera.com
Sep 24, 2026Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.CVE-2026-78308 · Other software · Deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com pellera.com
Aug 24, 2026SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-78317 · Other software · deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 24, 2026SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-78316 · Other software · deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 24, 2026SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-78315 · Other software · deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 24, 2026SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-78314 · Other software · deltaww · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.8
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57703 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57702 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57701 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Aug 18, 2025DIAEnergie - Stored Cross-site ScriptingCVE-2025-57700 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7
DIAEnergie - Stored Cross-site Scripting
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Oct 3, 2024Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx.CVE-2024-43699 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.3
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov deltaww.com
Oct 3, 2024Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx.CVE-2024-42417 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov deltaww.com
May 6, 2024A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior.CVE-2024-4549 · Other software · Delta Electronics · reported by vulnreport@tenable.comHigh 7.5
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
May 6, 2024An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4CVE-2024-4548 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
May 6, 2024A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted intoCVE-2024-4547 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
May 2, 2024 Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended dirCVE-2024-34033 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint.CVE-2024-34032 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx.CVE-2024-34031 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 1, 2024 SQL injection vulnerability exists in GetDIAE_usListParameters.CVE-2024-25574 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_usListParameters.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 It is possible to perform a path traversal attack and write outside of the intended directory.CVE-2024-28171 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 Improper neutralization of input within the affected product could lead to cross-site scripting.CVE-2024-28045 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 4.6
Improper neutralization of input within the affected product could lead to cross-site scripting.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_astListParameters.CVE-2024-28040 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_astListParameters.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 Path traversal attack is possible and write outside of the intended directory and may access sensitive information.CVE-2024-25567 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_slogListParameters.CVE-2024-23975 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_slogListParameters.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_unListParameters.CVE-2024-23494 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_unListParameters.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 SQL injection vulnerability exists in the script Handler_CFG.ashx.CVE-2024-28891 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script Handler_CFG.ashx.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalityCVE-2024-28029 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 21, 2024 SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.CVE-2024-25937 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Feb 17, 2023 The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizationCVE-2023-0822 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 17, 2022SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-43506 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 17, 2022SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetCVE-2022-43457 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 17, 2022SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NeCVE-2022-43452 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 17, 2022SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetwCVE-2022-43447 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Nov 17, 2022SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-41775 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud.CVE-2022-41773 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API.CVE-2022-41702 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API.CVE-2022-41701 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.CVE-2022-41651 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting ACVE-2022-41555 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters.CVE-2022-41133 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted.CVE-2022-40967 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 27, 2022The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.CVE-2022-40965 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 26, 2022The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.CVE-2022-43775 · Other software · Deltaww · reported by vulnreport@tenable.comCritical 9.8
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
Product
Diaenergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Oct 26, 2022The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote sysCVE-2022-43774 · Other software · Deltaww · reported by vulnreport@tenable.comCritical 9.8
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
Product
Diaenergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Jun 27, 2022A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitCVE-2022-33005 · Other software · Deltaww · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitrary web scripts via a crafted payload injected into the Name text field.
Product
Diaenergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 2, 2022Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx.CVE-2022-1378 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Product
DIAEnergie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.