Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jul 26, 2025A vulnerability was found in Roothub up to 2.6.CVE-2025-8211 · Other software · Roothub · reported by VulDBLow 2
A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path iCVE-2022-49962 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exists (one roothub) This causes a null pointer dereference in reboot for those controllers. Check that the shared_hcd exists before trying to remove it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 7, 2024Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function..CVE-2024-33124 · Other software · roothub · reported by MITRECritical 9.8
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function..
- Product
- roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function.CVE-2024-33122 · Other software · Roothub · reported by MITREMedium 6.3
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function.CVE-2024-33120 · Other software · roothub_project · reported by MITRECritical 9.8
Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows attackers to execute arbitrary code via a crafted JSP file.
- Product
- roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.CVE-2024-33121 · Other software · roothub · reported by MITREMedium 6.3
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.
- Product
- roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlegeCVE-2022-28052 · Other software · Roothub · reported by MITREHigh 8
Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlege to arbitrarily upload files via /common/upload API, which could lead to remote arbitrary code execution.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter rCVE-2022-27473 · Other software · Roothub Project · reported by MITRECritical 9.8
SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter reCVE-2022-27472 · Other software · Roothub Project · reported by MITRECritical 9.8
SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.
- Product
- Roothub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.