Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Apr 26, 2026A vulnerability was found in GreenCMS up to 2.3.CVE-2026-7044 · Other software · reported by VulDBLow 2.1
A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A vulnerability has been found in GreenCMS up to 2.3.CVE-2026-7043 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in GreenCMS up to 2.3. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traCVE-2019-25574 · Other software · Greencms · reported by VulnCheckHigh 7.1
Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences. Attackers can manipulate the theme_name parameter in the themeexporthandle action or supply base64-encoded file paths to the downfile action to retrieve sensitive files outside intended directories.
- Product
- Green CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreencms.netcodeload.github.com
Mar 21, 2026Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through tCVE-2019-25573 · Other software · Greencms · reported by VulnCheckHigh 7.1
Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cat parameter. Attackers can send GET requests to index.php with m=admin, c=posts, a=index parameters and inject SQL code in the cat parameter to manipulate database queries and extract sensitive information.
- Product
- Green CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgreencms.netcodeload.github.com
Dec 29, 2025A vulnerability was found in GreenCMS up to 2.3.CVE-2025-15187 · Other software · Njtech · reported by VulDBLow 2
A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025A flaw has been found in GreenCMS 2.3.0603.CVE-2025-14244 · Other software · Njtech · reported by VulDBLow 1.9
A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 25, 2025A vulnerability was identified in GreenCMS up to 2.3.0603.CVE-2025-9415 · Other software · Njtech · reported by VulDBLow 2.1
A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation of the argument upload[] leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts oCVE-2024-22570 · Other software · Njtech · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.CVE-2020-21366 · Other software · Njtech · reported by MITREHigh 8
Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.CVE-2022-28918 · Other software · Njtech · reported by MITREHigh 8.1
GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2018An issue was discovered in GreenCMS v2.3.0603.CVE-2018-19376 · Other software · Greencms · reported by MITREMedium 6.5
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehaCVE-2018-19329 · Other software · Greencms · reported by MITREMedium 4.9
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.CVE-2018-12988 · Other software · Greencms · reported by MITREHigh 7.5
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2018GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.CVE-2018-12604 · Other software · Njtech · reported by MITREHigh 7.5
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 1, 2018An issue was discovered in GreenCMS v2.3.0603.CVE-2018-11671 · Other software · Njtech · reported by MITREHigh 8.8
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 1, 2018An issue was discovered in GreenCMS v2.3.0603.CVE-2018-11670 · Other software · Njtech · reported by MITREHigh 8.8
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.
- Product
- Greencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.