Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Jan 12, 2026Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.pCVE-2025-67146 · Other software · Abhishekmali21 · reported by MITRECritical 9.4
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025A security flaw has been discovered in CodeAstro Gym Management System 1.0.CVE-2025-13172 · Other software · CodeAstro · reported by VulDBLow 2.1
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 2, 2025A vulnerability was determined in CodeAstro Gym Management System 1.0.CVE-2025-12610 · Other software · CodeAstro · reported by VulDBLow 2
A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 2, 2025A vulnerability was found in CodeAstro Gym Management System 1.0.CVE-2025-12609 · Other software · CodeAstro · reported by VulDBLow 2
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 27, 2025A vulnerability was found in CodeAstro Gym Management System 1.0.CVE-2025-12261 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 27, 2025A vulnerability has been found in CodeAstro Gym Management System 1.0.CVE-2025-12242 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 11, 2025A flaw has been found in CodeAstro Gym Management System 1.0.CVE-2025-11593 · Other software · CodeAstro · reported by VulDBLow 2.1
A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 11, 2025A vulnerability was detected in CodeAstro Gym Management System 1.0.CVE-2025-11592 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 11, 2025A security vulnerability has been detected in CodeAstro Gym Management System 1.0.CVE-2025-11591 · Other software · CodeAstro · reported by VulDBLow 2.1
A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 10, 2025A weakness has been identified in CodeAstro Gym Management System 1.0.CVE-2025-11590 · Other software · CodeAstro · reported by VulDBLow 2.1
A weakness has been identified in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/equipment-entry.php. Executing a manipulation of the argument ename can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 10, 2025A security flaw has been discovered in CodeAstro Gym Management System 1.0.CVE-2025-11589 · Other software · CodeAstro · reported by VulDBLow 2.1
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a manipulation of the argument plan results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 10, 2025A vulnerability was identified in CodeAstro Gym Management System 1.0.CVE-2025-11588 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of the argument fullname leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 10, 2025WPGYM - Wordpress Gym Management System: Privilege escalationCVE-2025-7049 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.7.0
- What to do
- Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Aug 16, 2025WPGYM - Wordpress Gym Management System: Unauthorized admin account creationCVE-2025-6080 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new users, including admins.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.7.0
- What to do
- Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Aug 16, 2025WPGYM - Wordpress Gym Management System: Local File InclusionCVE-2025-3671 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.7.0
- What to do
- Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 11, 2025WPGYM - Wordpress Gym Management System: SQL InjectionCVE-2025-7442 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.8.0
- What to do
- Affects up to 67.8.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 1, 2025CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.CVE-2025-29208 · Other software · Codezips · reported by MITREMedium 6.5
CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-2847 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file /dashboard/admin/over_month.php. The manipulation of the argument mm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0.CVE-2025-1959 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0. Affected is an unknown function of the file /change_s_pwd.php. The manipulation of the argument login_id/login_key leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-1856 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability was found in Codezips Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/gen_invoice.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-1854 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/del_member.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-1380 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/del_plan.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-1206 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/viewdetailroutine.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-1188 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/updateroutine.php. The manipulation of the argument tid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical.CVE-2025-1183 · Other software · CodeZips · reported by VulDBMedium 5.3
A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/more-userprofile.php. The manipulation of the argument login_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-0881 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/saveroutine.php. The manipulation of the argument rname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0880 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/updateplan.php. The manipulation of the argument planid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-0803 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0562 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/health_status_entry.php. The manipulation of the argument usrid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0541 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/edit_member.php. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability classified as critical has been found in Codezips Gym Management System 1.0.CVE-2025-0535 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-0532 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/new_submit.php. The manipulation of the argument m_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0231 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2024WPGYM - Wordpress Gym Management System: Arbitrary file uploadsCVE-2024-9942 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.1.0
- What to do
- Affects up to 67.1.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 23, 2024WPGYM - Wordpress Gym Management System: Privilege escalationCVE-2024-9941 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_staff_member() function in all versions up to, and including, 67.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new user accounts with the administrator role.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.1.0
- What to do
- Affects up to 67.1.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 28, 2023Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authentiCVE-2023-5185 · Other software · Gym Management System Project · reported by help@fluidattacks.comCritical 9.1
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
- Product
- Gym Management System Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Dec 13, 2022Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46062 · Other software · GYM Management System Project · reported by MITREMedium 4.5
Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2020An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable.CVE-2020-29288 · Other software · Admerc · reported by MITRECritical 9.8
An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable.
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.