Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
103 results · page 1 of 3
Oct 27, 2026In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found.CVE-2026-97045 · Other software · golang.org/x/net · reported by security@golang.org
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
- Product
- golang.org/x/net/html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Booster Elite for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
- Product
- Booster Elite for WooCommerce
- Fixed in
- 8.4.0
- What to do
- Update Booster Elite for WooCommerce to 8.4.0 or newer.
Jul 29, 2026Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability.CVE-2026-13309 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.8
Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability.CVE-2026-13308 · Other software · Autel · reported by zdi-disclosures@trendmicro.comHigh 8.1
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability.CVE-2026-13307 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.8
Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability.CVE-2026-13306 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 4.3
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability.CVE-2026-13305 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.4
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28276 · Other software · Morelitea · reported by GitHubHigh 7.5
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28275 · Other software · Morelitea · reported by GitHubHigh 8.1
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28274 · Other software · Morelitea · reported by GitHubHigh 8.7
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Magazine Elite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53244 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Elite magazine-elite allows PHP Local File Inclusion.This issue affects Magazine Elite: from n/a through <= 1.2.4.
- Product
- Magazine Elite
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Magazine Elite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.CVE-2025-52287 · Other software · Elite Project · reported by MITREHigh 8.8
OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.
- Product
- Elite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 20, 2025Elite Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54044 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Reflected XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
- Product
- Elite Video Player
- Affected
- up to 10.0.5
- What to do
- Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025RealtyElite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52808 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through <= 1.0.0.
- Product
- RealtyElite
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update RealtyElite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Elite Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30988 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
- Product
- Elite Video Player
- Affected
- up to 10.0.5
- What to do
- Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Elite Video Player: Cross-Site Request Forgery (CSRF)CVE-2025-30986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through <= 10.0.5.
- Product
- Elite Video Player
- Affected
- up to 10.0.5
- What to do
- Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() alloCVE-2025-1094 · Other software · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.1
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpostgresql.orgopenwall.com
Dec 13, 2024Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: Missing AuthorizationCVE-2024-54241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
- Product
- Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification
- What to do
- Update Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification to the newest version.
Nov 7, 2024An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25.CVE-2020-11926 · Other software · luvion · reported by MITREHigh 7.5
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web request, e.g., for a JavaScript file. Also, the disclosed information includes the SSID and WPA2 key for the Wi-Fi network the device is connected to.
- Product
- grand_elite_3_connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 2, 2024If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the JenCVE-2024-47804 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-23967 · Other software · Autel · reported by cve@asrg.ioHigh 8
Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 chargers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of base64-encoded data within WebSocket messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23230
- Product
- MaxiCharger AC Elite Business C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-23959 · Other software · Autel · reported by cve@asrg.ioHigh 8
Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the AppChargingControl BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23194
- Product
- MaxiCharger AC Elite Business C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability.CVE-2024-23958 · Other software · Autel · reported by cve@asrg.ioMedium 6.5
Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BLE AppAuthenRequest command handler. The handler uses hardcoded credentials as a fallback in case of an authentication request failure. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-23196
- Product
- MaxiCharger AC Elite Business C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-23957 · Other software · Autel · reported by cve@asrg.ioHigh 8.8
Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLB_HostHeartBeat handler of the DLB protocol implementation. When parsing an AES key, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23241
- Product
- MaxiCharger AC Elite Business C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-7795 · Other software · Autel · reported by zdi-disclosures@trendmicro.comHigh 8.8
Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AppAuthenExchangeRandomNum BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23384.
- Product
- MaxiCharger AC Elite Business C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Booster Elite for WooCommerce: Improper AuthenticationCVE-2023-51511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.
- Product
- Booster Elite for WooCommerce
- Fixed in
- 7.1.3
- What to do
- Update Booster Elite for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 28, 2024Booster Elite for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
- Product
- Booster Elite for WooCommerce
- Fixed in
- 7.1.2
- What to do
- Update Booster Elite for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 7, 2024Booster Elite for WooCommerce: Arbitrary file uploadsCVE-2024-1986 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled.
- Product
- Booster Elite for WooCommerce
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Booster Elite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbooster.ioplugins.trac.wordpress.org
Jan 10, 2024Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.CVE-2022-40361 · Other software · Elitecms · reported by MITREMedium 6.1
Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelitecrm.cohazemhussien99.wordpress.com
Oct 4, 2023If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipuCVE-2023-22618 · Other software · nokia · reported by MITREHigh 8.1
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.
- Product
- wavelite_metro_200_and_fan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component.CVE-2023-42331 · Other software · Elitecms · reported by MITREHigh 8.8
A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023ELITE TECHNOLOGY CORP.CVE-2023-28701 · Other software · ELITE · reported by twcert@cert.org.twCritical 9.8
ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service.
- Product
- Web Fax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 23, 2023The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress pCVE-2022-4017 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks
- Fixed in
- 6.0.1
- What to do
- Update the plugin to 6.0.1 or newer.
Dec 26, 2022The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress pCVE-2022-4227 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress plugin before 6.0.0 do not escape some URLs and parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Fixed in
- 5.6.3
- What to do
- Update the plugin to 5.6.3 or newer.
Dec 12, 2022The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress pCVE-2022-4016 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks
- Fixed in
- 5.6.7
- What to do
- Update the plugin to 5.6.7 or newer.
Nov 21, 2022The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress pCVE-2022-3763 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack
- Fixed in
- 5.6.7
- What to do
- Update the plugin to 5.6.7 or newer.
Nov 21, 2022The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress pCVE-2022-3762 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)
- Fixed in
- 5.6.7
- What to do
- Update the plugin to 5.6.7 or newer.
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.CVE-2022-30816 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=CVE-2022-30815 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.CVE-2022-30814 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.CVE-2022-30813 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.CVE-2022-30810 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.CVE-2022-30809 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.CVE-2022-30808 · Other software · Elitecms · reported by MITRECritical 9.8
elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=.CVE-2022-30804 · Other software · Elitecms · reported by MITREMedium 6.5
elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executionCVE-2021-39299 · Other software · HP · reported by hp-security-alert@hp.comHigh 8.8
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
- Product
- Elite Dragonfly Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2022eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.CVE-2022-24222 · Other software · Elitecms · reported by MITRECritical 9.8
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php.CVE-2022-24221 · Other software · Elitecms · reported by MITRECritical 9.8
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.CVE-2022-24220 · Other software · Elitecms · reported by MITRECritical 9.8
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.CVE-2022-24219 · Other software · Elitecms · reported by MITRECritical 9.8
eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.
- Product
- Elite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.