Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Dec 27, 2021A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a userCVE-2020-21236 · Other software · Damicms · reported by MITREHigh 8.8
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.CVE-2020-18458 · Other software · Damicms · reported by MITREHigh 8
Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.CVE-2020-18451 · Other software · Damicms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2019An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=TplCVE-2018-14831 · Other software · Damicms · reported by MITREMedium 4.9
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 28, 2018DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\CCVE-2018-20571 · Other software · Damicms · reported by MITREHigh 7.5
DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2018admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.CVE-2018-16331 · Other software · Damicms · reported by MITREHigh 8.8
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16239 · Other software · Damicms · reported by MITRECritical 9.8
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16238 · Other software · Damicms · reported by MITREHigh 7.2
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16237 · Other software · Damicms · reported by MITRELow 2.7
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2018An issue was discovered in DamiCMS 6.0.0.CVE-2018-15844 · Other software · Damicms · reported by MITREHigh 8.8
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jul 5, 2018DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.CVE-2018-13031 · Other software · Damicms · reported by MITREHigh 8.8
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.