Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
36 results
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87775 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Tz Weekly Radio Schedule
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87774 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Tz Weekly Radio Schedule
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-CVE-2026-82857 · Other software · kerberosmansour · reported by VulnCheckCritical 9.3
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
- Product
- hulumi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 25, 2026In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state.CVE-2026-47151 · Other software · Silicon Labs · reported by product-security@silabs.comHigh 7.1
In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.
- Product
- EmberZNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsiliconlabs.lightning.force.com
May 12, 2026Eight Day Week Print Workflow: Time-based blind SQL InjectionCVE-2026-5028 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Eight Day Week Print Workflow
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 23, 2026An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/CVE-2026-31169 · Other software · Totolink · reported by MITREMedium 6.5
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi.
- Product
- A3300r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Eight Day Week Print Workflow: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67621 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
- Product
- Eight Day Week Print Workflow
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2025Weekly Planner: Stored Cross-Site ScriptingCVE-2025-12186 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Weekly Planner
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Weekly Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 29, 2025Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS functiCVE-2023-41471 · Other software · 9001 · reported by MITREHigh 7.8
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.
- Product
- Copyparty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.CVE-2024-57023 · Other software · Totolink · reported by MITREMedium 6.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.CVE-2024-57012 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 28, 2024Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectCVE-2024-52283 · Other software · SUSE · reported by meissner@suse.deMedium 5.7
Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project
- Product
- hackweek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to eCVE-2024-51419 · Other software · shenzhen_interconnection_harbor_network_technology · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
- Product
- ofweek_online_exhibition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale).CVE-2024-23083 · Other software · reported by MITREMedium 5.3
Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 31, 2024Weekly Class Schedule: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31084 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pulsar Web Design Weekly Class Schedule allows Reflected XSS.This issue affects Weekly Class Schedule: from n/a through 3.19.
- Product
- Weekly Class Schedule
- Affected
- up to 3.19
- What to do
- Affects up to 3.19. Update Weekly Class Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 25, 2024HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue.CVE-2024-21865 · Other software · KDDI CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.
- Product
- HGW BL1500HM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue.CVE-2024-29071 · Other software · KDDI CORPORATION · reported by vultures@jpcert.or.jpHigh 8.8
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.
- Product
- HGW BL1500HM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hCVE-2023-45600 · Other software · AiLux · reported by prodsec@nozominetworks.comMedium 5.6
A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
- Product
- imx6 bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comnozominetworks.com
Oct 10, 2023Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in tCVE-2023-5499 · Other software · SHENZHEN REACHFAR TECHNOLOGY COMPANY LIMITED · reported by cve-coordination@incibe.esHigh 7.5
Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages, SOS device locations and device configurations.
- Product
- Shenzhen Reachfar v28
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.CVE-2022-44259 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrief-nymphea-813.notion.sitebrief-nymphea-813.notion.site
Oct 6, 2022TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRuCVE-2022-41524 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrief-nymphea-813.notion.sitebrief-nymphea-813.notion.site
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.CVE-2022-32051 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021Schedule Name" input in the Weekly Schedule: General options did not properly sanitize inputCVE-2021-24309 · WordPress plugins & themes · reported by WPScanMedium 5.4
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue
- Product
- Schedule Name" input in the Weekly Schedule
- Fixed in
- 3.4.3
- What to do
- Update Schedule Name" input in the Weekly Schedule to 3.4.3 or newer.
Nov 21, 2019Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.CVE-2014-0084 · Other software · rubygem-openshift-origin-node · reported by Red HatMedium 5.5
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
- Product
- rubygem-openshift-origin-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Oct 23, 2019The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.CVE-2015-9504 · WordPress plugins & themes · reported by MITREMedium 6.1
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
- Product
- weeklynews
- Fixed in
- 2.2.9
- What to do
- Update weeklynews to 2.2.9 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Nov 22, 2017FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability.CVE-2017-8191 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.9
FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links.
- Product
- FusionSphere OpenStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuawei.comsecurityfocus.com
Sep 8, 2014The Retale - Weekly Ads & Deals (aka com.retale.android) application 2.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-CVE-2014-5682 · Other software · Retale · reported by cret@cert.orgMedium 5.4
The Retale - Weekly Ads & Deals (aka com.retale.android) application 2.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Retale - Weekly ADS & Deals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Feb 26, 2010The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when coCVE-2010-0752 · Other software · Earl Dunovant · reported by MITREMedium 5
The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.
- Product
- Week
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2009SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commandCVE-2009-2734 · Other software · Achievo · reported by MITREHigh 7.5
SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.
- Product
- Achievo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Apr 7, 2009SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idroom parameter to weekview.php.CVE-2008-6634 · Other software · Beaussier · reported by MITREHigh 7.5
SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idroom parameter to weekview.php.
- Product
- Roomphplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Apr 12, 2007PHP remote file inclusion vulnerability in include/blocks/week_events.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in theCVE-2007-2014 · Other software · Mynews · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in include/blocks/week_events.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConf[path][sys][index] parameter, a different vector than CVE-2007-0633.
- Product
- Mynews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackberry.ath.cxosvdb.org
Mar 22, 2007Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a ..CVE-2007-1601 · Other software · Weekly Drawing Contest · reported by MITREMedium 5
Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows opening files
- Product
- Weekly Drawing Contest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Mar 22, 2007admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a diCVE-2007-1603 · Other software · Weekly Drawing Contest · reported by MITREHigh 7.5
admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request.
- Product
- Weekly Drawing Contest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Mar 22, 2007SQL injection vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter.CVE-2007-1602 · Other software · Weekly Drawing Contest · reported by MITREHigh 7.5
SQL injection vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter.
- Product
- Weekly Drawing Contest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Sep 20, 2006SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendaridCVE-2006-4906 · Other software · Marc Logemann · reported by MITREHigh 7.5
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendarid parameter.
- Product
- More.groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Jul 27, 2006Cross-site scripting (XSS) vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web script or HTML via the week parameter.CVE-2006-3909 · Other software · Wired Community Software · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web script or HTML via the week parameter.
- Product
- Wwwthreads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comaria-security.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.