Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 1 of 2
Oct 28, 2026Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote CVE-2026-104383 · Other software · EagleCloud · reported by mandiant-cve@google.comCritical 9.4
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
- Product
- Aquila
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026A flaw has been found in pig-mesh pig up to 4.1.0.CVE-2026-115997 · Other software · pig-mesh · reported by VulDBLow 2.1
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
- Product
- pig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via CVE-2026-111343 · Other software · pig-mesh · reported by VulnCheckMedium 5.3
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
- Product
- pig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Pix por Piggly (para Woocommerce): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42714 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
- Product
- Pix por Piggly (para Woocommerce)
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Pix por Piggly (para Woocommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and reaCVE-2026-92716 · Other software · Shuffle · reported by VulnCheckHigh 8.6
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.
- Product
- Shuffle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing CVE-2026-91995 · Other software · pig-mesh · reported by VulnCheckCritical 9.3
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
- Product
- pig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A vulnerability was identified in pig-mesh Pig up to 3.9.2.CVE-2026-15512 · Other software · pig-mesh · reported by VulDBLow 2.1
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated CVE-2026-12879 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cMedium 5.9
An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.
- Product
- Apigee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate seCVE-2026-2264 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.2
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
- Product
- Apigee-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Pigeon is a message board/notepad/social system/blog.CVE-2026-32616 · Other software · kasuganosoras · reported by GitHubHigh 8.2
Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.
- Product
- Pigeon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2025A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other ApigCVE-2025-13292 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.6
A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.
- Product
- Apigee-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comfocalsecurity.io
Dec 5, 2025A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remotCVE-2025-13426 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.7
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
- Product
- Apigee hybrid Javacallout policy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08).CVE-2025-63929 · Other software · Airpig2011 · reported by MITREHigh 7.5
A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via IEC10X_PrioEnQueue, the function may dereference a null or freed queue pointer, resulting in a segmentation fault and potential denial-of-service.
- Product
- Iec104
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsongsong.host
Nov 12, 2025A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08).CVE-2025-63927 · Other software · Airpig2011 · reported by MITREMedium 4
A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_Scheduled can access memory that has already been freed, potentially causing program crashes or undefined behavior. This may be exploited to trigger a denial-of-service or memory corruption.
- Product
- Iec104
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsongsong.host
Nov 7, 2025In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-tCVE-2025-63691 · Other software · Pig4cloud · reported by MITRECritical 9.6
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system.
- Product
- PIG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible tCVE-2025-63690 · Other software · Pig4cloud · reported by MITRECritical 9.1
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.
- Product
- PIG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins.CVE-2025-62784 · Other software · Phoenix616 · reported by GitHubMedium 5.3
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.5.
- Product
- InventoryGui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins.CVE-2025-62783 · Other software · Phoenix616 · reported by GitHubMedium 5
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT.
- Product
- InventoryGui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins.CVE-2025-62782 · Other software · Phoenix616 · reported by GitHubMedium 5.9
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.4-SNAPSHOT.
- Product
- InventoryGui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025A vulnerability was found in kasuganosoras Pigeon 1.0.177.CVE-2025-1447 · Other software · kasuganosoras · reported by VulDBMedium 5.3
A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.
- Product
- Pigeon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issCVE-2024-13268 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.8
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
- Product
- Opigno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local FiCVE-2024-13267 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
- Product
- Opigno TinCan Question Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File InclCVE-2024-13265 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
- Product
- Opigno Learning path
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.TCVE-2024-13264 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
- Product
- Opigno module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File InclCVE-2024-13263 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
- Product
- Opigno group manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_addCVE-2024-42612 · Other software · pigg · reported by MITREHigh 8.8
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts usingCVE-2024-28022 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.5
A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.
- Product
- FOXMAN-UN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: Make sure to free skb when it is completely used With the skb pointer piggyCVE-2021-47224 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: Make sure to free skb when it is completely used With the skb pointer piggy-backed on the TX BD, we have a simple and efficient way to free the skb buffer when the frame has been transmitted. But in order to avoid freeing the skb while there are still fragments from the skb in use, we need to piggy-back on the TX BD of the skb, not the first. Without this, we are doing use-after-free on the DMA side, when the first BD of a multi TX BD packet is seen as completed in xmit_done, and the remaining BDs are still being processed.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 5, 2023pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.CVE-2023-43269 · Other software · pigcms · reported by MITRECritical 9.8
pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.
- Product
- pigcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-37630 · Other software · Simple Online Piggery Management System Project · reported by MITREMedium 6.1
Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to "manage-breed.php" resulting in Persistent XSS.
- Product
- Simple Online Piggery Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jul 12, 2023Online Piggery Management System 1.0 is vulnerable to File Upload.CVE-2023-37629 · Other software · Simple Online Piggery Management System Project · reported by MITRECritical 9.8
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."
- Product
- Simple Online Piggery Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 12, 2023Online Piggery Management System 1.0 is vulnerable to SQL Injection.CVE-2023-37628 · Other software · Simple Online Piggery Management System Project · reported by MITRECritical 9.8
Online Piggery Management System 1.0 is vulnerable to SQL Injection.
- Product
- Simple Online Piggery Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 25, 2023Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content CVE-2023-25439 · Other software · Squarepiginteractive · reported by MITREMedium 6.1
Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.
- Product
- Fusioninvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 1, 2023Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server.CVE-2023-30859 · Other software · tritonmc · reported by GitHubHigh 7.2
Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to broadcast the 'triton:main' plugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4.
- Product
- Triton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability was found in pig-vector and classified as problematic.CVE-2022-4641 · Other software · unspecified · reported by VulDBLow 2.5
A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500.
- Product
- pig-vector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows aCVE-2022-40189 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
- Product
- Apache Airlfow Pig Provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Aug 5, 2021The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 requesCVE-2021-38095 · Other software · Planview · reported by MITREHigh 7.5
The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request.
- Product
- Spigit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complanview.com
Mar 3, 2021A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21.CVE-2020-28597 · Other software · Epignosishq · reported by talos-cna@cisco.comHigh 7.5
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
- Product
- Efront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 5, 2019An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier.CVE-2019-5070 · Other software · Epignosishq · reported by talos-cna@cisco.comMedium 6.5
An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
- Product
- Efront LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 5, 2019A code execution vulnerability exists in Epignosis eFront LMS v5.2.12.CVE-2019-5069 · Other software · Epignosishq · reported by talos-cna@cisco.comHigh 8.8
A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.
- Product
- Efront LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 29, 2019In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.CVE-2019-11500 · Other software · Dovecot · reported by MITRECritical 9.8
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 1, 2018Hue 3.12 has XSS via the /pig/save/ name and script parameters.CVE-2018-11649 · Other software · Gethue · reported by MITREMedium 6.1
Hue 3.12 has XSS via the /pig/save/ name and script parameters.
- Product
- HUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remoteCVE-2015-1559 · Other software · Epignosis · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that (1) delete modules via the delete_module parameter, (2) deactivate modules via the deactivate_module parameter, (3) activate modules via the activate_module parameter, (4) delete users via the delete_user parameter, (5) deactivate users via the deactivate_user parameter, (6) activate users via the activate_user parameter, (7) activate themes via the set_theme parameter, (8) deactivate themes via the set_theme parameter, (9) delete themes via the delete parameter, (10) deactivate events (user registration or email activation) via the deactivate_notification parameter, (11) activate events via the activate_notification parameter, (12) delete events via the delete_notification parameter, (13) deactivate language settings via the deactivate_language parameter, (14) activate language settings via the activate_language parameter, (15) delete language settings via the delete_language parameter, or (16) activate or deactivate the autologin feature for a user
- Product
- Efront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 21, 2015Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) ..CVE-2015-1191 · Other software · Zlib · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Product
- Pigz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 11, 2014Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary webCVE-2014-4033 · Other software · Efrontlearning · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary web script or HTML via the surname parameter to student.php.
- Product
- Efront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Apr 27, 2014Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of theCVE-2013-0296 · Other software · Zlib · reported by Red HatMedium 4.4
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
- Product
- Pigz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgmail.zlib.net
Apr 17, 2008SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2008-1870 · Other software · Geek247 · reported by MITREHigh 7.5
SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Pigmy-sql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Sep 18, 2007PHP remote file inclusion vulnerability in sample.php in YaPiG 0.95b allows remote attackers to execute arbitrary PHP code via a URL in the YAPIG_PATH parameterCVE-2007-4951 · Other software · Yapig · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in sample.php in YaPiG 0.95b allows remote attackers to execute arbitrary PHP code via a URL in the YAPIG_PATH parameter. NOTE: this issue has been disputed by CVE, since YAPIG_PATH is defined before use
- Product
- Yapig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarfis.wordpress.comosvdb.org
Aug 28, 2006Cross-site scripting (XSS) vulnerability in template/default/thanks_comment.php in Yet Another PHP Image Gallery (YaPIG) 0.95b allows remote attackers to injectCVE-2006-4421 · Other software · Yapig · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in template/default/thanks_comment.php in Yet Another PHP Image Gallery (YaPIG) 0.95b allows remote attackers to inject arbitrary web script or HTML via the D_REFRESH_URL parameter.
- Product
- Yapig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comarmorize.com
Dec 31, 2005Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administrators to inject arbitCVE-2005-4800 · Other software · Yapig · reported by MITREHigh 9
Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php, which inserts the code into guid_info.php. NOTE: this issue is easier to exploit due to a separate CSRF vulnerability.
- Product
- Yapig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.