Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,479 results · page 13 of 30
Feb 11, 2020Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.CVE-2012-4519 · Other software · Zenphoto · reported by Red HatMedium 6.1
Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.
- Product
- Zenphoto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 8, 2020Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remoCVE-2011-3642 · Other software · Flowplayer · reported by MITRECritical 9.6
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
- Product
- Flowplayer Flash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.CVE-2011-2706 · Other software · sNews · reported by Red HatMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
- Product
- sNews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Jan 9, 2020The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailinCVE-2012-2724 · Other software · Simplenews · reported by Red HatMedium 5.3
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
- Product
- Simplenews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2020There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parCVE-2019-20361 · WordPress plugins & themes · reported by MITRECritical 9.8
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).
- Fixed in
- 4.3.1
- What to do
- Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.CVE-2019-20337 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 7.2
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2019In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.CVE-2019-9554 · Other software · Craftcms · reported by MITREMedium 6.1
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 26, 2019The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensCVE-2019-6032 · Other software · Nippon Television Network Corporation · reported by vultures@jpcert.or.jpHigh 7.4
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- NTV News24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.CVE-2019-19985 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and emaiCVE-2019-19984 · WordPress plugins & themes · reported by MITREMedium 6.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.CVE-2019-19982 · WordPress plugins & themes · reported by MITREMedium 5.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.CVE-2019-19981 · WordPress plugins & themes · reported by MITREMedium 5.4
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 25, 2019The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) CVE-2019-19980 · WordPress plugins & themes · reported by MITREMedium 4.3
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp_ajax function to send_test_email.
- Fixed in
- 4.2.3
- What to do
- Update the plugin to 4.2.3 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Dec 9, 2019nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \PresentationCVE-2019-19682 · Websites & servers · Nopcommerce · reported by MITREMedium 4.8
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.
- Product
- Nopcommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2019The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.CVE-2011-4310 · Other software · The CMS Made Simple Foundation · reported by Red HatHigh 7.5
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
- Product
- CMSMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsmadesimple.orgcmsmadesimple.org
Nov 26, 2019Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.CVE-2019-14842 · Other software · [UNKNOWN] · reported by Red HatCritical 9.8
Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.
- Product
- libnbd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comredhat.com
Nov 6, 2019An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress.CVE-2018-20853 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.
- Product
- An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters)
- Fixed in
- 2.8.2
- What to do
- Update An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) to 2.8.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Nov 6, 2019Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /CCVE-2017-18639 · Other software · Progress · reported by MITREMedium 6.1
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.
- Product
- Sitefinity CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 23, 2019The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.CVE-2015-9504 · WordPress plugins & themes · reported by MITREMedium 6.1
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
- Product
- weeklynews
- Fixed in
- 2.2.9
- What to do
- Update weeklynews to 2.2.9 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 22, 2019The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.CVE-2015-9500 · WordPress plugins & themes · reported by MITREMedium 6.1
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
- Affected
- 1.3.3 to 1.3.3
- What to do
- Affects 1.3.3 to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 22, 2019The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.CVE-2015-9496 · WordPress plugins & themes · reported by MITREHigh 8.8
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
- Product
- freshmail-newsletter
- Fixed in
- 1.6
- What to do
- Update freshmail-newsletter to 1.6 or newer.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Oct 16, 2019CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.CVE-2019-17630 · Other software · Cmsmadesimple · reported by MITREMedium 4.8
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgforum.cmsmadesimple.org
Sep 23, 2019ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading CVE-2019-16720 · Other software · Zzzcms · reported by MITREHigh 7.5
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 20, 2019The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.CVE-2016-10999 · WordPress plugins & themes · reported by MITREMedium 6.1
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
- Product
- Goodnews
- Affected
- up to 2016-02-28
- What to do
- Affects up to 2016-02-28. Update Goodnews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.CVE-2016-10972 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
- Product
- newspaper
- Fixed in
- 6.7.2
- What to do
- Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Sep 16, 2019The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.CVE-2017-18634 · WordPress plugins & themes · reported by MITRECritical 9.8
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
- Product
- newspaper
- Fixed in
- 6.7.2
- What to do
- Update newspaper to 6.7.2 or newer.
Full record and what to do →NVD recordblog.sucuri.netblog.sucuri.net
Aug 22, 2019The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.CVE-2018-20987 · WordPress plugins & themes · reported by MITRECritical 9.8
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
- Product
- newsletters-lite
- Fixed in
- 4.6.8.6
- What to do
- Update newsletters-lite to 4.6.8.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The email-newsletter plugin through 20.15 for WordPress has SQL injection.CVE-2015-9334 · WordPress plugins & themes · reported by MITRECritical 9.8
The email-newsletter plugin through 20.15 for WordPress has SQL injection.
- Product
- email-newsletter
- Affected
- up to 20.15
- What to do
- Affects up to 20.15. Update email-newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-18575 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
- Product
- newstatpress
- Fixed in
- 1.2.5
- What to do
- Update newstatpress to 1.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.CVE-2017-18523 · WordPress plugins & themes · reported by MITREHigh 8.8
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
- Product
- eelv-newsletter
- Fixed in
- 4.6.1
- What to do
- Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.CVE-2017-18522 · WordPress plugins & themes · reported by MITREMedium 6.1
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
- Product
- eelv-newsletter
- Fixed in
- 4.6.1
- What to do
- Update eelv-newsletter to 4.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
- Product
- wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
- Fixed in
- 4.6.19
- What to do
- Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 14, 2019The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.CVE-2017-18512 · WordPress plugins & themes · reported by MITREHigh 8.8
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
- Product
- newsletter-by-supsystic
- Fixed in
- 1.1.8
- What to do
- Update newsletter-by-supsystic to 1.1.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.1 for WordPress has SQL injection.CVE-2015-9315 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
- Product
- newstatpress
- Fixed in
- 1.0.1
- What to do
- Update newstatpress to 1.0.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.CVE-2015-9314 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
- Product
- newstatpress
- Fixed in
- 1.0.4
- What to do
- Update newstatpress to 1.0.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.CVE-2015-9313 · WordPress plugins & themes · reported by MITRECritical 9.8
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
- Product
- newstatpress
- Fixed in
- 1.0.5
- What to do
- Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.CVE-2015-9312 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
- Product
- newstatpress
- Fixed in
- 1.0.5
- What to do
- Update newstatpress to 1.0.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.CVE-2015-9311 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
- Product
- newstatpress
- Fixed in
- 1.0.6
- What to do
- Update newstatpress to 1.0.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2019The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameterCVE-2019-14787 · WordPress plugins & themes · reported by MITREMedium 5.4
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
- Product
- Tribulant Newsletters
- Fixed in
- 4.6.19
- What to do
- Update Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 28, 2019An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicCVE-2019-14364 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
- Product
- Email Subscribers & Newsletters
- Affected
- 4.1.6 to 4.1.6
- What to do
- Affects 4.1.6 to 4.1.6. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Jul 19, 2019A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.CVE-2019-13569 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
- Product
- A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters
- Affected
- up to 4.1.7
- What to do
- Affects up to 4.1.7. Update A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 11, 2019hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.CVE-2019-13507 · Other software · Hidea · reported by MITRECritical 9.8
hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
- Product
- AZ Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 10, 2019An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI.CVE-2019-12724 · Other software · Teclib-edition · reported by MITREMedium 6.1
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter.
- Product
- News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2019CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.CVE-2019-11226 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 29, 2019WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or CVE-2019-11592 · Other software · Webidsupport · reported by MITREMedium 6.1
WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php.
- Product
- Webid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Apr 22, 2019An issue was discovered in CutePHP CuteNews 2.1.2.CVE-2019-11447 · Other software · Cutephp · reported by MITREHigh 8.8
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
- Product
- Cutenews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compentest.com.tr
Mar 26, 2019CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News moduCVE-2019-10106 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgdev.cmsmadesimple.org
Mar 7, 2019EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.CVE-2018-18449 · Other software · Phome · reported by MITREHigh 8.8
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2019PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar.CVE-2019-8361 · Other software · Responsive Video News Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
- Product
- Responsive Video News Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Dec 23, 2018BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error.CVE-2018-20405 · Other software · bigtreecms · reported by MITRELow 2.7
BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.
- Product
- bigtree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.