Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

922 results · page 11 of 19

Feb 8, 2024An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.CVE-2023-40265 · Email & office · Mitel · reported by MITREHigh 8.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.
Product
Unify Openscape Xpressions Webassistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record networks.unify.com networks.unify.com
Feb 6, 2024In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentationCVE-2024-24938 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Feb 5, 2024Unlimited Addons for WPBakery Page Builder: Arbitrary file uploadsCVE-2023-6925 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin (the default is editor role, but access can also be granted to contributor role), to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Unlimited Addons for WPBakery Page Builder
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update Unlimited Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2024 There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escaCVE-2023-6926 · Other software · Crestron · reported by ics-cert@hq.dhs.govHigh 8.4
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
Product
AM-300
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jan 11, 2024The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited.CVE-2023-50123 · Other software · Hozard · reported by MITREHigh 8.1
The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state.
Product
Alarm System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secura.com secura.com
Jan 8, 2024Essential Real Estate: Does not prevent users with limited privileges on the siteCVE-2023-6140 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API.CVE-2023-29051 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Dec 27, 2023An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript coCVE-2023-43481 · Other software · sshenzhen_tcl_new_technology_co_limited · reported by MITRECritical 9.8
An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.
Product
com.tcl.browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 26, 2023Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver.CVE-2023-46681 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 7.8
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product's command line interface to execute an arbitrary command.
Product
VR-S1000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp buffalo.jp
Dec 21, 2023Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48722 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Student Result Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48720 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Student Result Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48718 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Student Result Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48716 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of the add_classes.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Student Result Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48689 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Railway Reservation System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48687 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Railway Reservation System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48685 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Railway Reservation System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-44482 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Leave Management System Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-44481 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Leave Management System Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45121 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45120 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45119 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45118 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45117 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'eid' parameter of the /update.php?q=rmquiz resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45116 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities.CVE-2023-45115 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comHigh 8.8
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Examination System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 21, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company CVE-2023-6145 · Other software · İstanbul Soft Informatics and Consultancy Limited Company · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software allows SQL Injection. This issue affects Softomi Advanced C2C Marketplace Software: before 12122023.
Product
Softomi Advanced C2C Marketplace Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 21, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company CVE-2023-6122 · Other software · İstanbul Soft Informatics and Consultancy Limited Company · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Gelişmiş C2C Pazaryeri Yazılımı allows Reflected XSS. This issue affects Softomi Gelişmiş C2C Pazaryeri Yazılımı: before 12122023.
Product
Softomi Gelişmiş C2C Pazaryeri Yazılımı
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 21, 2023Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a reqCVE-2023-48291 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.
Product
Apache Airflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Dec 20, 2023Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48434 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the reg_action.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Voting System Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 20, 2023Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-48433 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the login_action.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Voting System Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Dec 20, 2023Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-40204 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Unrestricted Upload of File with Dangerous TypeCVE-2023-31231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromiCVE-2023-6912 · Other software · M-Files Corporation · reported by security@m-files.comHigh 7.5
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
Product
M-Files Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record empower.m-files.com product.m-files.com
Dec 4, 2023In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a missing bounds check.CVE-2023-40075 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a missing bounds check. This could lead to local denial of service which results in a boot loop with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Nov 22, 2023Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command eCVE-2023-6157 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 7.6
Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Nov 22, 2023Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestCVE-2023-6156 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 7.6
Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Nov 17, 2023CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.CVE-2023-47675 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpHigh 7.2
CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.
Product
CubeCart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.cubecart.com jvn.jp
Nov 17, 2023Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the systCVE-2023-47283 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpMedium 4.9
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system.
Product
CubeCart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.cubecart.com jvn.jp
Nov 17, 2023Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and fCVE-2023-42428 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system.
Product
CubeCart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.cubecart.com jvn.jp
Nov 17, 2023Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system.CVE-2023-38130 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpHigh 8.1
Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system.
Product
CubeCart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.cubecart.com jvn.jp
Nov 15, 2023An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request toCVE-2023-41442 · Other software · Kloudq · reported by MITRECritical 9.8
An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component.
Product
TOR Loco MIN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record writeups.ayyappan.me writeups.ayyappan.me
Nov 14, 2023SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-23830 · Other software · AMD · reported by psirt@amd.comLow 1.9
SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.
Product
3rd Gen AMD EPYC™ Processors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 12, 2023Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack.CVE-2023-47163 · Other software · Remarshal-project · reported by vultures@jpcert.or.jpHigh 7.5
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.
Product
Remarshal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46800 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46793 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46789 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46788 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46787 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46785 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Matrimonial Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 7, 2023Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46679 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Job Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.