Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Jul 9, 2026SOPlanning is vulnerable to SQL injection in the audit retention configuration.CVE-2026-50644 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.6
SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user). This issue was fixed in version 1.56.01.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints.CVE-2026-40549 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning does not verify uploaded file extension.CVE-2026-40548 · Other software · SOPlanning · reported by cvd@cert.plMedium 6.4
SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning is vulnerable to Path Traversal in backup endpoints.CVE-2026-40547 · Other software · SOPlanning · reported by cvd@cert.plMedium 6.4
SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters.CVE-2026-40546 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.7
SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning is vulnerable to Reflected XSS via the taches parameter.CVE-2026-40545 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.CVE-2026-40544 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026SOPlanning does not enforce authorization for backup functionalities.CVE-2026-40543 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.8
SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.CVE-2024-33724 · Other software · reported by MITREMedium 5.4
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].CVE-2024-33722 · Other software · reported by MITREMedium 6.3
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Stored XSS in /feries endpoint.CVE-2025-62731 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. By default only administrators and users with special privileges are able to access this endpoint. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Privilege Escalation in user management tab.CVE-2025-62730 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.7
SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Stored XSS in /status endpoint.CVE-2025-62729 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Stored XSS in /projets endpoint.CVE-2025-62297 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Stored XSS in /taches endpoint.CVE-2025-62296 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint.CVE-2025-62295 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Predictable Generation of Password Recovery Token.CVE-2025-62294 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.7
SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025SOPlanning is vulnerable to Broken Access Control in /status endpoint.CVE-2025-62293 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.3
SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sendinCVE-2025-41001 · Other software · SOPlanning · reported by cve-coordination@incibe.esMedium 5.1
Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php.CVE-2024-57170 · Other software · Soplanning · reported by MITREMedium 6.5
SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemcsam.github.iothemcsam.github.io
Mar 18, 2025A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php.CVE-2024-57169 · Other software · Soplanning · reported by MITRECritical 9.8
A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemcsam.github.iothemcsam.github.io
Oct 7, 2024SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a speciallyCVE-2024-9574 · Other software · SOPlanning · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specialCVE-2024-9573 · Other software · SOPlanning · reported by cve-coordination@incibe.esMedium 6.3
SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in theCVE-2024-9572 · Other software · SOPlanning · reported by cve-coordination@incibe.esMedium 6.3
Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session details.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecCVE-2024-9571 · Other software · SOPlanning · reported by cve-coordination@incibe.esMedium 6.3
Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and partially take control of their browser session.
- Product
- SOPlanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2021SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public.CVE-2020-13963 · Other software · Soplanning · reported by MITRECritical 9.8
SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgforum.soplanning.org
Oct 7, 2020SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings.CVE-2020-25867 · Other software · Soplanning · reported by MITREMedium 5.3
SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2020SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.CVE-2020-15597 · Other software · Soplanning · reported by MITREMedium 5.4
SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsevenlayers.comsoplanning.org
Feb 22, 2020SOPlanning 1.45 allows XSS via the Name or Comment to status.php.CVE-2020-9339 · Other software · Soplanning · reported by MITREMedium 5.4
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2020SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.CVE-2020-9338 · Other software · Soplanning · reported by MITREMedium 5.4
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.CVE-2020-9269 · Other software · Soplanning · reported by MITREHigh 7.2
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.CVE-2020-9268 · Other software · Soplanning · reported by MITREHigh 7.5
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.CVE-2020-9267 · Other software · Soplanning · reported by MITREMedium 6.5
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.CVE-2020-9266 · Other software · Soplanning · reported by MITREMedium 6.5
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2020SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.CVE-2019-20179 · Other software · Soplanning · reported by MITREHigh 8.8
SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2020Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)befCVE-2014-8673 · Other software · Soplanning · reported by MITRECritical 9.8
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 6, 2020Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness aCVE-2014-8674 · Other software · Soplanning · reported by MITREMedium 5.4
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 31, 2017The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a cCVE-2014-8677 · Other software · Soplanning · reported by MITREMedium 5.3
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 31, 2017Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitraCVE-2014-8676 · Other software · Soplanning · reported by MITREMedium 5.3
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 31, 2017Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendaCVE-2014-8675 · Other software · Soplanning · reported by MITREHigh 7.5
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.