Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Mar 1, 2025A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9.CVE-2025-1799 · Other software · Zorlan · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- SkyCaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2025A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical.CVE-2025-1791 · Other software · Zorlan · reported by VulDBMedium 5.3
A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- SkyCaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save.CVE-2024-39243 · Other software · skycaiji · reported by MITRECritical 9.8
An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save.
- Product
- skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comfushuling.com
Jun 26, 2024A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload using eval(String.frCVE-2024-39242 · Other software · Skycaiji · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload using eval(String.fromCharCode()).
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comfushuling.com
Jun 26, 2024Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview.CVE-2024-39241 · Other software · Skycaiji · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comfushuling.com
Jun 22, 2024A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic.CVE-2024-6252 · Other software · Zorlan · reported by VulDBMedium 5.1
A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Task Handler. The manipulation of the argument onerror leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269419.
- Product
- SkyCaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comvuldb.com
May 26, 2023skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS).CVE-2023-33394 · Other software · Skycaiji · reported by MITREMedium 5.4
skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious JSON data.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwanheiqiyihu.topwanheiqiyihu.top
Dec 7, 2022Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.CVE-2022-44351 · Other software · Skycaiji · reported by MITRECritical 9.8
Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.CVE-2022-28096 · Other software · Skycaiji · reported by MITREHigh 7.2
Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2021Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStCVE-2020-18878 · Other software · Skycaiji · reported by MITREMedium 5.3
Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2018SkyCaiji 1.2 allows CSRF to add an Administrator user.CVE-2018-11371 · Other software · Skycaiji · reported by MITREHigh 8.8
SkyCaiji 1.2 allows CSRF to add an Administrator user.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.