Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
744 results · page 11 of 15
Apr 9, 2024Contao is an open source content management system.CVE-2024-30262 · Other software · contao · reported by GitHubMedium 5.9
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28235 · Other software · contao · reported by GitHubHigh 8.3
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28234 · Other software · contao · reported by GitHubMedium 4.3
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28191 · Other software · contao · reported by GitHubLow 3.1
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28190 · Other software · contao · reported by GitHubMedium 5.4
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2024InstantCMS is a free and open source content management system.CVE-2024-31213 · Other software · instantsoft · reported by GitHubLow 3.5
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024InstantCMS is a free and open source content management system.CVE-2024-31212 · Other software · instantsoft · reported by GitHubMedium 6.7
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo.CVE-2024-30248 · Other software · piccolo-orm · reported by GitHubHigh 7.7
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
- Product
- piccolo_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data.CVE-2024-27091 · Other software · GeoNode · reported by GitHubMedium 6.1
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28119 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28118 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28117 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28116 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-27921 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Grav is a content management system (CMS).CVE-2024-27923 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Umbraco is an ASP.NET content management system.CVE-2024-28868 · Other software · umbraco · reported by GitHubLow 3.7
Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops.CVE-2024-28187 · Other software · inunosinsi · reported by GitHubHigh 7.2
SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Sulu is a PHP content management system.CVE-2024-27915 · Other software · sulu · reported by GitHubMedium 6.8
Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Kirby is a content management system.CVE-2024-27087 · Other software · getkirby · reported by GitHubMedium 4.6
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code,CVE-2023-48987 · Other software · Cusg · reported by MITREHigh 7.5
Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmgsecurity.comlmgsecurity.com
Feb 14, 2024Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrarCVE-2023-48986 · Other software · Cusg · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the users.php component.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmgsecurity.comlmgsecurity.com
Feb 14, 2024Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrarCVE-2023-48985 · Other software · Cusg · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the login.php component.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmgsecurity.comlmgsecurity.com
Feb 13, 2024TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2024-25121 · Other software · TYPO3 · reported by GitHubHigh 7.1
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2024-25120 · Other software · TYPO3 · reported by GitHubMedium 4.3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.typo3.orggithub.com
Feb 13, 2024TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2024-25119 · Other software · TYPO3 · reported by GitHubMedium 4.9
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2024-25118 · Other software · TYPO3 · reported by GitHubMedium 4.3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Sulu is a highly extensible open-source PHP content management system based on the Symfony framework.CVE-2024-24807 · Other software · sulu · reported by GitHubLow 2.7
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Silverstripe Framework is the framework that forms the base of the Silverstripe content management system.CVE-2023-48714 · Other software · silverstripe · reported by GitHubMedium 4.3
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.
- Product
- silverstripe-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsilverstripe.org
Jan 3, 2024Craft is a content management system.CVE-2024-21622 · Other software · craftcms · reported by GitHubMedium 5.4
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023Winter is a free, open-source content management system.CVE-2023-52085 · Other software · wintercms · reported by GitHubLow 3.3
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023Winter is a free, open-source content management system.CVE-2023-52084 · Other software · wintercms · reported by GitHubLow 2
Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023Winter is a free, open-source content management system.CVE-2023-52083 · Other software · wintercms · reported by GitHubLow 2
Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-49279 · Other software · umbraco · reported by GitHubLow 3.7
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.umbraco.comgithub.com
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-49278 · Other software · umbraco · reported by GitHubMedium 5.3
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-49274 · Other software · umbraco · reported by GitHubLow 3.7
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-49273 · Other software · umbraco · reported by GitHubMedium 5.4
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-49089 · Other software · umbraco · reported by GitHubHigh 7.7
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-48313 · Other software · umbraco · reported by GitHubMedium 4.3
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-48227 · Other software · umbraco · reported by GitHubMedium 4.3
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Umbraco is an ASP.NET content management system (CMS).CVE-2023-38694 · Other software · umbraco · reported by GitHubLow 3.5
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023October is a Content Management System (CMS) and web platform to assist with development workflow.CVE-2023-44382 · Other software · octobercms · reported by GitHubCritical 9.1
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023October is a Content Management System (CMS) and web platform to assist with development workflow.CVE-2023-44381 · Other software · octobercms · reported by GitHubMedium 4.9
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can craft a special request to include PHP code in the CMS template. This issue has been patched in version 3.4.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023October is a Content Management System (CMS) and web platform to assist with development workflow.CVE-2023-44383 · Other software · octobercms · reported by GitHubMedium 5.4
October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the CVE-2023-47350 · Other software · Swiftyedit · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality.
- Product
- Swiftyedit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commechaneus.github.io
Nov 21, 2023Statamic CMS is a Laravel and Git powered content management system (CMS).CVE-2023-48701 · Other software · statamic · reported by GitHubHigh 7.5
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2023-47127 · Other software · TYPO3 · reported by GitHubMedium 4.2
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2023-47126 · Other software · TYPO3 · reported by GitHubLow 3.7
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023TYPO3 is an open source PHP based web content management system released under the GNU GPL.CVE-2023-47125 · Other software · TYPO3 · reported by GitHubMedium 4.7
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Statmic is a core Laravel content management system Composer package.CVE-2023-47129 · Other software · statamic · reported by GitHubHigh 8.3
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023Wagtail is an open source content management system built on Django.CVE-2023-45809 · Other software · wagtail · reported by GitHubLow 2.7
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.