Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

1,479 results · page 11 of 30

Feb 23, 2023pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.CVE-2022-36231 · Other software · Newspaperclub · reported by MITRECritical 9.8
pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.
Product
PDF Info
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 13, 2023Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.CVE-2022-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
Fixed in
1.0.16
What to do
Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2023News & Blog Designer Pack: Does not validate and escape one of its shortcode attributesCVE-2022-4792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
News & Blog Designer Pack
Fixed in
3.3
What to do
Update News & Blog Designer Pack to 3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2023A vulnerability was found in stevejagodzinski DevNewsAggregator.CVE-2014-125040 · Other software · stevejagodzinski · reported by VulDBMedium 5.5
A vulnerability was found in stevejagodzinski DevNewsAggregator. It has been rated as critical. Affected by this issue is the function getByName of the file php/data_access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name leads to sql injection. The name of the patch is b9de907e7a8c9ca9d75295da675e58c5bf06b172. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217484.
Product
DevNewsAggregator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Dec 27, 2022A vulnerability was found in moodle-block_sitenews 1.0.CVE-2020-36633 · Other software · Moodle-block Sitenews Project · reported by VulDBMedium 4.3
A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879.
Product
Moodle-block Sitenews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 22, 2022An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.CVE-2022-41654 · Other software · Ghost Foundation · reported by talos-cna@cisco.comMedium 4.3
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
Product
Ghost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com talosintelligence.com
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47411 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
Product
FP Newsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47410 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
Product
FP Newsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47409 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.
Product
FP Newsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47408 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
Product
FP Newsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Nov 16, 2022Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.CVE-2022-44070 · Other software · Tribalsystems · reported by MITREMedium 5.4
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
Product
Zenario
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 14, 2022tagDiv Composer WordPress plugin before 3.5, required by the Newspaper: And Newsmag WordPress theme before 5CVE-2022-3477 · WordPress plugins & themes · reported by WPScanCritical 9.8
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Product
tagDiv Composer WordPress plugin before 3.5, required by the Newspaper
Fixed in
3.5
What to do
Update tagDiv Composer WordPress plugin before 3.5, required by the Newspaper to 3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.
Product
Newspaper
Fixed in
12
What to do
Update Newspaper to 12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting
Product
Newspaper
Fixed in
12
What to do
Update Newspaper to 12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 13, 2022ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.CVE-2022-41495 · Other software · Clippercms · reported by MITRECritical 9.8
ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.
Product
Clippercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 12, 2022OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newlCVE-2022-41403 · Other software · Newsletter Subscribe (popup + Regular Module) Project · reported by MITRECritical 9.8
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
Product
Newsletter Subscribe (popup + Regular Module)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
Product
Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
Fixed in
2.1.2
What to do
Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module.CVE-2022-34963 · Other software · Openteknik · reported by MITREMedium 5.4
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module.
Product
Open Source Social Network
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 16, 2022A vulnerability was found in Itech News Portal 6.28.CVE-2017-20131 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Product
News Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com exploit-db.com
Jul 5, 2022Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.CVE-2022-31856 · Other software · Newsletter Module Project · reported by MITRECritical 9.8
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
Product
Newsletter Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 24, 2022A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4.CVE-2017-20094 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4. This issue affects some unknown processing. The manipulation leads to basic cross site scripting (Persistent). The attack may be initiated remotely. Upgrading to version 1.2.5 is able to address this issue. It is recommended to upgrade the affected component.
Product
NewStatPress Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org vuldb.com
Jun 20, 2022Newsletter: Does not escape and sanitise the preheader_text settingCVE-2022-1889 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
Product
Newsletter
Fixed in
7.4.6
What to do
Update Newsletter to 7.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Product
Newsletter
Fixed in
7.4.5
What to do
Update Newsletter to 7.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2022CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php.CVE-2021-40961 · Other software · Cmsmadesimple · reported by MITREHigh 8.8
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
Product
CMS Made Simple
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com packetstormsecurity.com
May 31, 2022TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads.CVE-2022-31011 · Other software · pingcap · reported by GitHubHigh 7.8
TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.
Product
tidb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.CVE-2022-29669 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.
Product
Cscms Music Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.CVE-2022-29665 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.
Product
Cscms Music Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.CVE-2022-29662 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.
Product
Cscms Music Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 6, 2022Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or highCVE-2021-36912 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.CVE-2022-27369 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.
Product
Cscms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.CVE-2022-24608 · Other software · Luocms Project · reported by MITREMedium 6.1
Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.
Product
Luocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.CVE-2022-24607 · Other software · Luocms Project · reported by MITRECritical 9.8
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.
Product
Luocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.CVE-2022-24606 · Other software · Luocms Project · reported by MITRECritical 9.8
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
Product
Luocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.CVE-2022-24603 · Other software · Luocms Project · reported by MITRECritical 9.8
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.
Product
Luocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.CVE-2022-24602 · Other software · Luocms Project · reported by MITRECritical 9.8
Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.
Product
Luocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2022Ditty (formerly Ditty News Ticker): Is affected by a Reflected Cross-Site Scripting (XSS) vulnerabilityCVE-2022-0533 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Ditty (formerly Ditty News Ticker)
Fixed in
3.0.15
What to do
Update Ditty (formerly Ditty News Ticker) to 3.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Product
Email Subscribers & Newsletters
Fixed in
5.3.2
What to do
Update Email Subscribers & Newsletters to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
NewStatPress
Fixed in
1.3.6
What to do
Update NewStatPress to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
Product
WordPress Newsletter
Fixed in
1.6.5
What to do
Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.31
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.25
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2022nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference aCVE-2021-46283 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org git.kernel.org
Dec 20, 2021MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser.CVE-2021-43844 · Other software · rcmaehl · reported by GitHubHigh 8.8
MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability requires user interaction and the acceptance of a prompt. With how MSEdgeRedirect is coded, parameters are impossible to pass to any launched file. However, there are two possible scenarios in which an attacker can do more than a minor annoyance. In Scenario 1 (confirmed), a user visits an attacker controlled webpage; the user is prompted with, and downloads, an executable payload; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and RCE executes the payload the user previously downloaded, if the download path is successfully guessed. In Scenario 2 (not yet confirmed), a user visits an attacked controlled webpage; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and a payload on a remote, attacker controlled, SMB server is executed. The issue was found in the _DecodeAndRun() function, in which I incorrectly assumed _WinAPI_UrlIs() would only accept web resources. Unfortunately, file:/// pass
Product
MSEdgeRedirect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 30, 2021nextcloud news-android is an Android client for the Nextcloud news/feed reader app.CVE-2021-41256 · Other software · nextcloud · reported by GitHubMedium 5.8
nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
Product
news-android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2021Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module.CVE-2020-23039 · Other software · Newsoftwares · reported by MITREMedium 5.4
Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name.
Product
Folder Lock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Aug 16, 2021Simple Popup Newsletter: Reflected Cross-Site ScriptingCVE-2021-34658 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7.
Product
Simple Popup Newsletter
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Simple Popup Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 13, 2021The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-38302 · Other software · Newsletter Project · reported by MITRECritical 9.8
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
Product
Newsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.CVE-2021-36792 · Other software · Dated News Project · reported by MITREHigh 7.2
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.
Product
Dated News
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.CVE-2021-36791 · Other software · Dated News Project · reported by MITREMedium 5.3
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.
Product
Dated News
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.CVE-2021-36790 · Other software · Dated News Project · reported by MITREMedium 6.1
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.
Product
Dated News
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.