Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
35added in the last 30 days
575new WordPress flaws this week
391,358entries in the database

670 results · page 10 of 14

  • Jan 30, 2019An issue was discovered in idreamsoft iCMS 7.0.13.CVE-2019-7234 · Other software · Idreamsoft · reported by MITRECritical 9.1

    An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 29, 2019idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHPCVE-2019-7160 · Other software · Idreamsoft · reported by MITRECritical 9.8

    idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 14, 2019An issue was discovered in idreamsoft iCMS V7.0.13.CVE-2019-6259 · Other software · Icmsdev · reported by MITRECritical 9.8

    An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2018WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue toCVE-2018-20572 · Other software · Wuzhicms · reported by MITRECritical 9.8

    WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2018DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\CCVE-2018-20571 · Other software · Damicms · reported by MITREHigh 7.5

    DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.CVE-2018-20520 · Other software · 1234n · reported by MITREMedium 6.1

    MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 15, 2018An issue was discovered in DiliCMS 2.4.0.CVE-2018-19291 · Other software · Dilicms · reported by MITREMedium 6.5

    An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.

    Product
    Dilicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 5, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18938 · Other software · Wuzhicms · reported by MITREMedium 4.8

    An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18936 · Other software · Popojicms · reported by MITREHigh 7.5

    An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter.

    Product
    Popojicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18935 · Other software · Popojicms · reported by MITREHigh 8.8

    An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.

    Product
    Popojicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18934 · Other software · Popojicms · reported by MITRECritical 9.8

    An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF.

    Product
    Popojicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 31, 2018MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.CVE-2018-18892 · Other software · 1234n · reported by MITRECritical 9.8

    MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 31, 2018MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.CVE-2018-18891 · Other software · 1234n · reported by MITREHigh 7.5

    MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 31, 2018MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.CVE-2018-18890 · Other software · 1234n · reported by MITREMedium 5.3

    MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 29, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18712 · Other software · Wuzhicms · reported by MITREHigh 8.8

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 29, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-18711 · Other software · Wuzhicms · reported by MITREHigh 8.8

    An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 29, 2018spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, anCVE-2018-18702 · Other software · Icmsdev · reported by MITRECritical 9.8

    spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 10, 2018XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter.CVE-2018-18210 · Other software · Dilicms · reported by MITREMedium 6.1

    XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter.

    Product
    Dilicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 10, 2018XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.CVE-2018-18209 · Other software · Dilicms · reported by MITREMedium 6.1

    XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.

    Product
    Dilicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2018An issue was discovered in DuomiCMS 3.0.CVE-2018-18084 · Other software · Comsenz · reported by MITRECritical 9.8

    An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter.

    Product
    Duomicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 9, 2018An issue was discovered in DuomiCMS 3.0.CVE-2018-18083 · Other software · Comsenz · reported by MITRECritical 9.8

    An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter because "eval" is used during "if" processing.

    Product
    Duomicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 1, 2018XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.CVE-2018-17832 · Other software · Wuzhicms · reported by MITREMedium 6.1

    XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.

    Product
    Wuzhi CMS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 21, 2018IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentCVE-2018-1710 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364.

    Product
    DB2 for Linux, UNIX and Windows
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 15, 2018An issue was discovered in yiqicms through 2016-11-20.CVE-2018-17077 · Other software · Yiqicms Project · reported by MITREMedium 6.1

    An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed.

    Product
    Yiqicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 14, 2018MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.CVE-2018-17039 · Other software · 1234n · reported by MITREMedium 6.1

    MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 2, 2018An issue was discovered in idreamsoft iCMS V7.0.10.CVE-2018-16366 · Other software · Idreamsoft · reported by MITREHigh 8.8

    An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 2, 2018An issue was discovered in idreamsoft iCMS V7.0.10.CVE-2018-16365 · Other software · Idreamsoft · reported by MITREHigh 8.8

    An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2018An issue was discovered in iCMS 7.0.9.CVE-2018-16332 · Other software · Idreamsoft · reported by MITREHigh 8.8

    An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2018admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.CVE-2018-16331 · Other software · Damicms · reported by MITREHigh 8.8

    admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2018idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.CVE-2018-16320 · Other software · Idreamsoft · reported by MITREHigh 7.2

    idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2018An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11.CVE-2018-16314 · Other software · Icmsdev · reported by MITREHigh 8.8

    An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 31, 2018An issue was discovered in MiniCMS 1.10.CVE-2018-16298 · Other software · 1234n · reported by MITREMedium 6.1

    An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16239 · Other software · Damicms · reported by MITRECritical 9.8

    An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16238 · Other software · Damicms · reported by MITREHigh 7.2

    An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 30, 2018An issue was discovered in damiCMS V6.0.1.CVE-2018-16237 · Other software · Damicms · reported by MITRELow 2.7

    An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 30, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.CVE-2018-16233 · Other software · 1234n · reported by MITREMedium 6.1

    MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 27, 2018An issue was discovered in MiniCMS 1.10.CVE-2018-15899 · Other software · 1234n · reported by MITREMedium 6.1

    An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 27, 2018An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames assCVE-2018-15895 · Other software · Icmsdev · reported by MITREHigh 7.5

    An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 25, 2018An issue was discovered in DamiCMS 6.0.0.CVE-2018-15844 · Other software · Damicms · reported by MITREHigh 8.8

    An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 20, 2018MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injectionCVE-2018-1000638 · Other software · 1234n · reported by MITREMedium 6.1

    MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.

    Product
    Minicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 2, 2018An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private aCVE-2018-14858 · Other software · Icmsdev · reported by MITREHigh 7.5

    An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 25, 2018LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovCVE-2018-14083 · Other software · Lica · reported by MITREHigh 7.5

    LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovery of a password hash.

    Product
    Minicmts E8k Firmware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 23, 2018An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified oCVE-2018-14514 · Other software · Icmsdev · reported by MITRECritical 9.8

    An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 23, 2018An XSS vulnerability was discovered in WUZHI CMS 4.1.0.CVE-2018-14512 · Other software · Wuzhicms · reported by MITREMedium 6.1

    An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server" screen, the XSS payload is triggered.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 20, 2018An issue was discovered in WUZHI CMS 4.1.0.CVE-2018-14472 · Other software · Wuzhicms · reported by MITREHigh 7.2

    An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken directly into execution without any filtering, leading to SQL injection.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 19, 2018An issue was discovered in idreamsoft iCMS before 7.0.10.CVE-2018-14415 · Other software · Icmsdev · reported by MITREMedium 6.1

    An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 10, 2018An issue was discovered in idreamsoft iCMS 7.0.9.CVE-2018-13865 · Other software · Idreamsoft · reported by MITREMedium 6.1

    An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 5, 2018DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.CVE-2018-13031 · Other software · Damicms · reported by MITREHigh 8.8

    DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account.

    Product
    Damicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 15, 2018spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.CVE-2018-12498 · Other software · Icmsdev · reported by MITRECritical 9.8

    spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.

    Product
    Icms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 5, 2018WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.CVE-2018-11722 · Other software · Wuzhicms · reported by MITRECritical 9.8

    WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.

    Product
    Wuzhicms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.