Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Aug 4, 2026A vulnerability has been found in kalcaddle kodbox 1.67 Build 02.CVE-2026-18721 · Other software · kalcaddle · reported by VulDBLow 2.1
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A flaw has been found in kalcaddle kodbox 1.67 Build 02.CVE-2026-18720 · Other software · kalcaddle · reported by VulDBMedium 5.5
A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A security vulnerability has been detected in kalcaddle Kodbox up to 1.64.CVE-2026-8753 · Other software · kalcaddle · reported by VulDBLow 2.1
A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A vulnerability was detected in kalcaddle kodbox up to 1.64.CVE-2026-5618 · Other software · kalcaddle · reported by VulDBLow 2.9
A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026A security flaw has been discovered in kalcaddle kodbox 1.64.CVE-2026-4831 · Other software · kalcaddle · reported by VulDBLow 2.9
A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026A vulnerability was identified in kalcaddle kodbox 1.64.CVE-2026-4830 · Other software · kalcaddle · reported by VulDBLow 2.9
A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A security vulnerability has been detected in kalcaddle kodbox 1.64.CVE-2026-4592 · Other software · kalcaddle · reported by VulDBLow 2.9
A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A weakness has been identified in kalcaddle kodbox 1.64.CVE-2026-4591 · Other software · kalcaddle · reported by VulDBLow 2
A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the file /workspace/source-code/plugins/fileThumb/app.php of the component fileThumb Endpoint. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A security flaw has been discovered in kalcaddle kodbox 1.64.CVE-2026-4590 · Other software · kalcaddle · reported by VulDBLow 1.3
A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/controller/bind/index.class.php of the component loginSubmit API. Performing a manipulation of the argument third results in cross-site request forgery. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A vulnerability was identified in kalcaddle kodbox 1.64.CVE-2026-4589 · Other software · kalcaddle · reported by VulDBLow 2.1
A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A vulnerability was determined in kalcaddle kodbox 1.64.CVE-2026-4588 · Other software · kalcaddle · reported by VulDBLow 2.9
A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/shareOut.class.php of the component Site-level API key Handler. This manipulation of the argument sk causes use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability has been found in kalcaddle kodbox up to 1.64.05.CVE-2026-2560 · Other software · kalcaddle · reported by VulDBLow 2.1
A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class.php of the component Media File Preview Plugin. Such manipulation of the argument localFile leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 17, 2026A vulnerability was detected in kalcaddle kodbox up to 1.61.10.CVE-2026-1066 · Other software · kalcaddle · reported by VulDBLow 2.1
A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Compression Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09.CVE-2025-11016 · Other software · kalcaddle · reported by VulDBLow 2.1
A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/index.class.php. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A security vulnerability has been detected in kalcaddle kodbox 1.61.CVE-2025-10233 · Other software · kalcaddle · reported by VulDBLow 2.1
A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability was found in kalcaddle kodbox 1.61.CVE-2025-9414 · Other software · kalcaddle · reported by VulDBLow 2
A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of the component Download from Link Handler. Performing manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Nov 15, 2024An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.CVE-2024-51037 · Other software · kalcaddle · reported by MITREMedium 5.3
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtommonkey.cn
Jan 16, 2024kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.CVE-2023-52069 · Other software · Kodcloud · reported by MITREMedium 5.4
kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Jan 16, 2024kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.CVE-2023-52068 · Other software · Kodcloud · reported by MITREMedium 6.1
kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Jan 16, 2024An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request.CVE-2023-39691 · Other software · Kodcloud · reported by MITRECritical 9.8
An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Dec 16, 2023A vulnerability was found in kalcaddle kodbox up to 1.48.CVE-2023-6849 · Other software · kalcaddle · reported by VulDBHigh 7.3
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The patch is identified as 63a4d5708d210f119c24afd941d01a943e25334c. It is recommended to upgrade the affected component. VDB-248210 is the identifier assigned to this vulnerability.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability was found in kalcaddle kodbox up to 1.48.CVE-2023-6848 · Other software · kalcaddle · reported by VulDBHigh 7.3
A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The identifier of the patch is 63a4d5708d210f119c24afd941d01a943e25334c. It is recommended to upgrade the affected component. The identifier VDB-248209 was assigned to this vulnerability.
- Product
- kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023kodbox 1.46.01 has a security flaw that enables user enumeration.CVE-2023-48028 · Other software · Kodcloud · reported by MITRECritical 9.8
kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnitipoom-jar.github.io
Oct 23, 2023kodbox 1.44 is vulnerable to Cross Site Scripting (XSS).CVE-2023-45998 · Other software · Kodcloud · reported by MITREMedium 5.4
kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Customizing global HTML results in storing XSS.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 10, 2023A vulnerability was found in kodbox 1.26.CVE-2023-3607 · Other software · Kodcloud · reported by VulDBMedium 5.5
A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.CVE-2023-29790 · Other software · Kodcloud · reported by MITREHigh 7.5
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
May 11, 2023kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.CVE-2023-29791 · Other software · Kodcloud · reported by MITREMedium 6.1
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.