Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,479 results · page 12 of 30
Aug 13, 2021The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.CVE-2021-36789 · Other software · Dated News Project · reported by MITRECritical 9.8
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.
- Product
- Dated News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commandCVE-2020-21976 · Other software · Newsone CMS Project · reported by MITREHigh 8.8
An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands.
- Product
- Newsone CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Aug 9, 2021Newsmag: Does not sanitise the td_block_id parameter in its td_ajax_block AJAX actionCVE-2021-24304 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
- Product
- Newsmag
- Fixed in
- 5.0
- What to do
- Update Newsmag to 5.0 or newer.
Aug 5, 2021Nifty Newsletters: Cross-Site Request ForgeryCVE-2021-34634 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
- Product
- Nifty Newsletters
- Affected
- up to 4.0.23
- What to do
- Affects up to 4.0.23. Update Nifty Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 5, 2021NewsPlugin: Cross-Site Request ForgeryCVE-2021-34631 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
- Product
- NewsPlugin
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update NewsPlugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 30, 2021Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.CVE-2020-22765 · Other software · Nukeviet · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
- Product
- Nukeviet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnukeviet.vnnukeviet.vn
Jul 30, 2021SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.CVE-2020-21808 · Other software · Nukeviet · reported by MITRECritical 9.8
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
- Product
- Nukeviet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.CVE-2020-23241 · Other software · Cmsmadesimple · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgdev.cmsmadesimple.org
Jul 19, 2021An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress.CVE-2021-3135 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.
- Product
- tagDiv Newspaper
- Affected
- 10.3.9.1 to 10.3.9.1
- What to do
- Affects 10.3.9.1 to 10.3.9.1. Update tagDiv Newspaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtagdiv.comthemeforest.net
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacCVE-2021-20743 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
- Product
- Sendit WP Newsletter
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 7, 2021JNews: Did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*)CVE-2021-24342 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
- Product
- JNews
- Fixed in
- 8.0.6
- What to do
- Update JNews to 8.0.6 or newer.
Jun 1, 2021A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attaCVE-2020-27377 · Other software · Cmsmadesimple · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgdev.cmsmadesimple.org
May 14, 2021In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.CVE-2020-23689 · Other software · Yfcmf · reported by MITREMedium 4.8
In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
- Product
- Yfcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021SABnzbd is an open source binary newsreader.CVE-2021-29488 · Other software · sabnzbd · reported by GitHubMedium 4.3
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.
- Product
- sabnzbd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry oCVE-2021-30171 · Other software · Jun-He Technology Ltd. · reported by twcert@cert.org.twMedium 4.6
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
- Product
- ERP POS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 31, 2021ps_emailsubscription is a newsletter subscription module for the PrestaShop platform.CVE-2021-21418 · Websites & servers · PrestaShop · reported by GitHubMedium 4.6
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Product
- ps_emailsubscription
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML via thCVE-2020-29241 · Other software · Online News Portal Project · reported by MITREMedium 4.8
Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML via the "Title" parameter.
- Product
- Online News Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
- Product
- A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers)CVE-2020-35932 · WordPress plugins & themes · reported by MITREHigh 7.5
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
- Product
- Insecure Deserialization in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update Insecure Deserialization in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Nov 30, 2020In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks.CVE-2020-29364 · Other software · Netartmedia · reported by MITREMedium 4.8
In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news titles.
- Product
- News Lister
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnetartmedia.net
Nov 25, 2020osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.CVE-2020-29070 · Websites & servers · Oscommerce · reported by MITREMedium 4.8
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
- Product
- Oscommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.oscommerce.comgithub.com
Nov 24, 2020SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.CVE-2020-25475 · Other software · Newsscriptphp · reported by MITRECritical 9.8
SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.
- Product
- News Script PHP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2020SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.CVE-2020-25474 · Other software · Newsscriptphp · reported by MITREMedium 6.1
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
- Product
- News Script PHP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.websec.nlwebsec.nl
Nov 24, 2020SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.CVE-2020-25473 · Other software · Newsscriptphp · reported by MITREMedium 6.5
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.
- Product
- News Script PHP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.websec.nlwebsec.nl
Nov 24, 2020SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.CVE-2020-25472 · Other software · Newsscriptphp · reported by MITREMedium 6.5
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.
- Product
- News Script PHP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.websec.nlwebsec.nl
Nov 13, 2020SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile ApplicatioCVE-2020-26825 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.
- Product
- SAP Fiori Launchpad (News Tile Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Nov 10, 2020Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.CVE-2020-25268 · Other software · Ilias · reported by MITREHigh 8.8
Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2020SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web aCVE-2020-26815 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.6
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.
- Product
- SAP Fiori Launchpad (News Tile Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
- Fixed in
- 4.5.6
- What to do
- Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 24, 2020DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticatCVE-2020-19878 · Other software · Dbhcms Project · reported by MITREHigh 7.5
DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information.
- Product
- Dbhcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2020[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [CalendarCVE-2020-5616 · Websites & servers · PHP Factory · reported by vultures@jpcert.or.jpCritical 9.8
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] free edition ver1.0.0, [Gallery01] free edition ver1.0.3 and earlier, [CalendarForm01] free edition ver1.0.3 and earlier, and [Link01] free edition ver1.0.0 allows remote attackers to bypass authentication and log in to the product with administrative privileges via unspecified vectors.
- Product
- [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01]
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 alloCVE-2020-5768 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 4.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
- Affected
- 4.4.8 to 4.4.8
- What to do
- Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 17, 2020Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legCVE-2020-5767 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
- Affected
- 4.4.8 to 4.4.8
- What to do
- Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 2, 2020In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.CVE-2020-13761 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
May 19, 2020Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and someCVE-2020-11807 · Other software · Sourcefabric · reported by MITREHigh 7.8
Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and sometimes terminal commands) on a server by making an avatar update and then visiting the avatar file under the /images/ path.
- Product
- Newscoop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.CVE-2020-12700 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.CVE-2020-12698 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.CVE-2020-5558 · Other software · CutePHP.com · reported by vultures@jpcert.or.jpHigh 8.8
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.
- Product
- CuteNews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2020Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2020-5557 · Other software · CutePHP.com · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- CuteNews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2020CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.CVE-2020-10494 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.CVE-2020-10488 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.CVE-2020-10479 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sCVE-2020-10477 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.CVE-2020-10468 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 9, 2020JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.CVE-2015-7342 · Other software · Joobi · reported by MITREHigh 7.2
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
- Product
- Jnews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Mar 9, 2020JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.CVE-2015-7341 · Other software · Joobi · reported by MITREHigh 8.8
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
- Product
- Jnews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Mar 9, 2020SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.CVE-2014-1634 · Websites & servers · Magento · reported by MITRECritical 9.8
SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.
- Product
- Advanced Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Mar 9, 2020JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.CVE-2015-7343 · Other software · Joobi · reported by MITREMedium 4.8
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
- Product
- Jnews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Feb 12, 2020SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands vCVE-2015-5617 · Other software · Enorth · reported by MITRECritical 9.8
SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
- Product
- Webpublisher CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.