Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Dec 11, 2025xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitraryCVE-2024-58313 · Other software · xbtitfm · reported by VulnCheckHigh 8.6
xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.
- Product
- xbtitFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Dec 11, 2025xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters.CVE-2024-58312 · Other software · xbtitfm · reported by VulnCheckHigh 8.7
xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like using encoded path traversal characters in HTTP requests.
- Product
- xbtitFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Dec 11, 2025xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL coCVE-2024-58309 · Other software · xbtitfm · reported by VulnCheckHigh 8.7
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.
- Product
- xbtitFM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 16, 2022A cross-site scripting vulnerability is present in Xbtit 3.1.CVE-2021-45822 · Other software · Btiteam · reported by MITREMedium 6.1
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" (POST) parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemaragkos.grgithub.com
Mar 16, 2022A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user.CVE-2021-45821 · Other software · Btiteam · reported by MITREHigh 8.8
A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user. As a result, a malicious user can extract sensitive data such as usernames and passwords and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemaragkos.grgithub.com
Oct 1, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-17870 · Other software · Btiteam · reported by MITREMedium 6.1
An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open redirect, a different vulnerability than CVE-2018-15683.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-16361 · Other software · Btiteam · reported by MITREMedium 6.1
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT.CVE-2018-15684 · Other software · Btiteam · reported by MITREMedium 5.3
An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictable file names, which can lead to full path disclosure and leakage of sensitive data.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT.CVE-2018-15683 · Other software · Btiteam · reported by MITREMedium 6.1
An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT.CVE-2018-15682 · Other software · Btiteam · reported by MITREHigh 8.8
An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-15681 · Other software · Btiteam · reported by MITRECritical 9.8
An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-15680 · Other software · Btiteam · reported by MITRECritical 9.8
An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-15679 · Other software · Btiteam · reported by MITREMedium 6.1
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT 2.5.4.CVE-2018-15678 · Other software · Btiteam · reported by MITREMedium 6.1
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Sep 5, 2018The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item.CVE-2018-15677 · Other software · Btiteam · reported by MITREMedium 6.1
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Sep 5, 2018An issue was discovered in BTITeam XBTIT.CVE-2018-15676 · Other software · Btiteam · reported by MITREMedium 5.3
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrastating.github.iorastating.github.io
Aug 26, 2008SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows remote attackers to execute arbitrary SQL cCVE-2008-3784 · Other software · Btitracker Project · reported by MITREHigh 7.5
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows remote attackers to execute arbitrary SQL commands via the info_hash parameter.
- Product
- Btitracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.