Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 5, 2021waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add.CVE-2020-21506 · Other software · Waimai Super CMS Project · reported by MITREMedium 6.1
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.CVE-2020-21505 · Other software · Waimai Super CMS Project · reported by MITREMedium 6.1
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.CVE-2020-21504 · Other software · Waimai Super CMS Project · reported by MITREMedium 6.1
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.CVE-2020-21503 · Other software · Waimai Super CMS Project · reported by MITREHigh 7.5
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2019In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter.CVE-2018-18261 · Other software · Bijiadao · reported by MITREMedium 6.1
In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2019An issue was discovered in Waimai Super Cms 20150505.CVE-2019-7585 · Other software · Bijiadao · reported by MITRECritical 9.8
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2019An issue was discovered in Waimai Super Cms 20150505.CVE-2019-7567 · Other software · Bijiadao · reported by MITREMedium 6.1
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2019An issue was discovered in Waimai Super Cms 20150505.CVE-2019-3577 · Other software · Bijiadao · reported by MITRECritical 9.8
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection via the id[0] parameter to the /product URI.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018An issue was discovered in Waimai Super Cms 20150505.CVE-2018-18622 · Other software · Bijiadao · reported by MITREMedium 6.1
An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI.CVE-2018-18082 · Other software · Bijiadao · reported by MITREMedium 6.1
XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2018SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.CVE-2018-17391 · Other software · Super CMS Blog Pro Project · reported by MITRECritical 9.8
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
- Product
- Super CMS Blog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 1, 2018In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.CVE-2018-16315 · Other software · Bijiadao · reported by MITREMedium 6.5
In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.CVE-2018-16157 · Other software · Bijiadao · reported by MITREMedium 5.3
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save item_totals parameter to zero, the entire cart is sold for free.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2018In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.CVE-2018-15570 · Other software · Bijiadao · reported by MITREMedium 4.8
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
- Product
- Waimai Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2018In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd.CVE-2018-14014 · Other software · Super CMS Project · reported by MITREHigh 8.8
In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd.
- Product
- Super CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.