Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
884 results · page 12 of 18
Sep 18, 2024Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails.CVE-2024-46986 · Other software · owen2345 · reported by GitHubCritical 9.9
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- camaleon-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comgithub.com
Sep 9, 2024Craft is a content management system (CMS).CVE-2024-45406 · Other software · craftcms · reported by GitHubMedium 5.5
Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Tina is an open-source content management system (CMS).CVE-2024-45391 · Other software · tinacms · reported by GitHubHigh 7.5
Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Xibo is an open source digital signage platform with a web content management system (CMS).CVE-2024-43413 · Other software · xibosignage · reported by GitHubLow 3.5
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Xibo is an open source digital signage platform with a web content management system (CMS).CVE-2024-43412 · Other software · xibosignage · reported by GitHubMedium 4.6
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. This is intended functionality. When previewing these resources from the Library and Layout editor they are executed in the users browser. This will be disabled in future releases, and users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. This behavior has been changed in 4.1.0 to preview previewing of generic files. There are no workarounds for this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Ghost is a Node.js content management system.CVE-2024-43409 · Other software · TryGhost · reported by GitHubMedium 6.5
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Xibo is a content management system (CMS).CVE-2024-41944 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Xibo is a content management system (CMS).CVE-2024-41804 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Xibo is a content management system (CMS).CVE-2024-41803 · Other software · xibosignage · reported by GitHubMedium 4.9
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Xibo is a content management system (CMS).CVE-2024-41802 · Other software · xibosignage · reported by GitHubHigh 8.1
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024Craft is a content management system (CMS).CVE-2024-41800 · Other software · craftcms · reported by GitHubMedium 4.8
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024Wagtail is an open source content management system built on Django.CVE-2024-39317 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration fileCVE-2024-4836 · Other software · Edito · reported by cvd@cert.plHigh 7.5
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.
- Product
- Edito CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024toy-blog is a headless content management system implementation.CVE-2024-39314 · Other software · KisaragiEffective · reported by GitHubMedium 4.7
toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.
- Product
- toy-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024toy-blog is a headless content management system implementation.CVE-2024-39313 · Other software · KisaragiEffective · reported by GitHubMedium 6.5
toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.
- Product
- toy-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024Strapi is an open-source content management system.CVE-2024-34065 · Other software · strapi · reported by GitHubHigh 7.1
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024Strapi is an open-source content management system.CVE-2024-31217 · Other software · strapi · reported by GitHubMedium 5.3
Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024Strapi is an open-source content management system.CVE-2024-29181 · Other software · strapi · reported by GitHubLow 2.3
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024Formwork is a flat file-based Content Management System (CMS).CVE-2024-37160 · Other software · getformwork · reported by GitHubMedium 4.8
Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.
- Product
- formwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Wagtail is an open source content management system built on Django.CVE-2024-35228 · Other software · wagtail · reported by GitHubMedium 5.5
Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability in `ModelViewSet` by registering the model as a snippet instead. No workaround is available for `wagtail.contrib.settings`.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024TYPO3 is an enterprise content management system.CVE-2024-34358 · Other software · TYPO3 · reported by GitHubMedium 5.3
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024TYPO3 is an enterprise content management system.CVE-2024-34357 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024TYPO3 is an enterprise content management system.CVE-2024-34356 · Other software · TYPO3 · reported by GitHubMedium 5.4
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024TYPO3 is an enterprise content management system.CVE-2024-34355 · Other software · TYPO3 · reported by GitHubLow 3.5
TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.CVE-2024-34310 · Other software · bjjfsd · reported by MITREHigh 8.8
Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.
- Product
- jin_fang_times_content_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024Wagtail is an open source content management system built on Django.CVE-2024-32882 · Other software · wagtail · reported by GitHubLow 2.7
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wagtail.orgdocs.wagtail.org
Apr 24, 2024Umbraco workflow provides workflows for the Umbraco content management system.CVE-2024-32872 · Other software · umbraco · reported by GitHubMedium 5.5
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
- Product
- Umbraco.Workflow.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.CVE-2024-29023 · Other software · xibosignage · reported by GitHubHigh 7.2
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this vulnerability.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.CVE-2024-29022 · Other software · xibosignage · reported by GitHubHigh 8.8
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script into the session page to exfiltrate session IDs and User Agents. These session IDs / User Agents can subsequently be used to hijack active sessions. A malicious script can be injected into the display grid to exfiltrate information related to displays. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Upgrading to a fixed version is necessary to remediate. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this issue.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-30262 · Other software · contao · reported by GitHubMedium 5.9
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28235 · Other software · contao · reported by GitHubHigh 8.3
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28234 · Other software · contao · reported by GitHubMedium 4.3
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28191 · Other software · contao · reported by GitHubLow 3.1
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Contao is an open source content management system.CVE-2024-28190 · Other software · contao · reported by GitHubMedium 5.4
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2024InstantCMS is a free and open source content management system.CVE-2024-31213 · Other software · instantsoft · reported by GitHubLow 3.5
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024InstantCMS is a free and open source content management system.CVE-2024-31212 · Other software · instantsoft · reported by GitHubMedium 6.7
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo.CVE-2024-30248 · Other software · piccolo-orm · reported by GitHubHigh 7.7
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
- Product
- piccolo_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data.CVE-2024-27091 · Other software · GeoNode · reported by GitHubMedium 6.1
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28119 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28118 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28117 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-28116 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Grav is an open-source, flat-file content management system.CVE-2024-27921 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Grav is a content management system (CMS).CVE-2024-27923 · Other software · getgrav · reported by GitHubHigh 8.8
Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Umbraco is an ASP.NET content management system.CVE-2024-28868 · Other software · umbraco · reported by GitHubLow 3.7
Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops.CVE-2024-28187 · Other software · inunosinsi · reported by GitHubHigh 7.2
SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Sulu is a PHP content management system.CVE-2024-27915 · Other software · sulu · reported by GitHubMedium 6.8
Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Kirby is a content management system.CVE-2024-27087 · Other software · getkirby · reported by GitHubMedium 4.6
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code,CVE-2023-48987 · Other software · Cusg · reported by MITREHigh 7.5
Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmgsecurity.comlmgsecurity.com
Feb 14, 2024Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrarCVE-2023-48986 · Other software · Cusg · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the users.php component.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmgsecurity.comlmgsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.