Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,092 results · page 13 of 22
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 17, 2023IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder.CVE-2023-23637 · Other software · Unistra · reported by MITREHigh 7.6
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder. This may allow attackers to steal Protected Health Information.
- Product
- Impatient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 12, 2023Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields.CVE-2022-46369 · Other software · Rumpus · reported by cna@cyber.gov.ilMedium 6.8
Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields.
- Product
- FTP server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Multi Step Form: Does not sanitise and escape some of its form fieldsCVE-2022-4196 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Multi Step Form
- Fixed in
- 1.7.8
- What to do
- Update Multi Step Form to 1.7.8 or newer.
Jan 9, 2023Memory corruption in display driver due to incorrect type casting while accessing the fence structure fieldsCVE-2022-25715 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 22, 2022An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files.CVE-2022-41977 · Other software · OpenImageIO Project · reported by talos-cna@cisco.comLow 3.3
An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- OpenImageIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgtalosintelligence.com
Dec 21, 2022A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paylCVE-2022-40841 · Other software · Ndk-design · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.
- Product
- Ndkadvancedcustomizationfields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022WP CSV Exporter: Does not properly escape the fieldsCVE-2022-3605 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
- Product
- WP CSV Exporter
- Fixed in
- 1.3.7
- What to do
- Update WP CSV Exporter to 1.3.7 or newer.
Dec 11, 2022Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields.CVE-2022-44637 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Dec 5, 2022The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.CVE-2022-35256 · Other software · NodeJS · reported by support@hackerone.comMedium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comhackerone.com
Nov 23, 2022Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.CVE-2022-45278 · Other software · Jizhicms · reported by MITREHigh 8.8
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.CVE-2022-40842 · Other software · Ndk-design · reported by MITRECritical 9.1
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.
- Product
- Ndkadvancedcustomizationfields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022It was discovered that Kibana was not sanitizing document fields containing HTML snippets.CVE-2021-37936 · Other software · Elastic · reported by security@elastic.coMedium 5.4
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Nov 9, 2022A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scriptCVE-2022-43120 · Other software · Intelliants · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Contact Form: Does not validate and escape fieldsCVE-2022-3463 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- Product
- Contact Form
- Fixed in
- 4.3.13
- What to do
- Update Contact Form to 4.3.13 or newer.
Nov 4, 2022Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.CVE-2021-39473 · Other software · Hotelmanager Project · reported by MITREMedium 5.4
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.
- Product
- Hotelmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.CVE-2022-40840 · Other software · Ndk-design · reported by MITREMedium 6.1
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
- Product
- Ndkadvancedcustomizationfields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate databaseCVE-2022-40839 · Other software · Ndk-design · reported by MITREHigh 7.5
A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
- Product
- Ndkadvancedcustomizationfields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022 The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privCVE-2022-40288 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022 Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-sCVE-2022-39017 · Other software · M-Files · reported by vdp@themissinglink.com.auHigh 8.2
Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.
- Product
- Hubshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 31, 2022U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields.CVE-2022-39026 · Other software · e-Excellence Inc. · reported by twcert@cert.org.twMedium 5.4
U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform XSS (Stored Cross-Site Scripting) attack.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 28, 2022Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host ECVE-2022-3228 · Other software · Host Engineering · reported by ics-cert@hq.dhs.govMedium 6.5
Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive.
- Product
- H0-ECOM100 Communications Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administCVE-2022-40184 · Other software · Bosch · reported by psirt@bosch.comMedium 5.1
Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.
- Product
- VIDEOJET multi 4000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2022Post to CSV by BestWebSoft: Does not properly escape fieldsCVE-2022-3393 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
- Product
- Post to CSV by BestWebSoft
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 20223scale API Management 2 does not perform adequate sanitation for user input in multiple fields.CVE-2022-1414 · Other software · Redhat · reported by Red HatHigh 8.8
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.
- Product
- 3scale API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 17, 2022A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials.CVE-2019-14840 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials.
- Product
- Decision Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 13, 2022Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.CVE-2022-34021 · Other software · Resiot · reported by MITREMedium 5.4
Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.
- Product
- IOT Platform And Lorawan Network Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Sep 16, 2022Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.CVE-2022-37247 · Other software · Craftcms · reported by MITREMedium 5.4
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.integrity.pt
Sep 1, 2022IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields.CVE-2021-39045 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WordPress Comments Fields
- Fixed in
- 4.1
- What to do
- Update WordPress Comments Fields to 4.1 or newer.
Jul 27, 2022Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored croCVE-2022-36902 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Dynamic Extended Choice Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 25, 2022W-DALIL: Does not sanitise and escape some of its fieldsCVE-2022-2340 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- W-DALIL
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update W-DALIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2022404s: Does not sanitise and escape its fieldsCVE-2022-2118 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- 404s
- Fixed in
- 3.5.1
- What to do
- Update 404s to 3.5.1 or newer.
Jul 7, 2022The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function.CVE-2022-32567 · Other software · Appfire · reported by MITREMedium 5.4
The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function.
- Product
- Jira Misc Custom Fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarketplace.atlassian.comsyss.de
Jul 6, 2022Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server.CVE-2022-26348 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.2
Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jun 30, 2022Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-CVE-2022-34777 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins GitLab Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Image Gallery: Does not sanitize and escape some of its Image fieldsCVE-2022-1327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Image Gallery
- Fixed in
- 1.1.6
- What to do
- Update Image Gallery to 1.1.6 or newer.
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.CVE-2022-32366 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=.CVE-2022-32365 · Other software · Product Show Room Site Project · reported by MITREHigh 7.2
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=.
- Product
- Product Show Room Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2022-31398 · Other software · Helpdeskz · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Appointment Hour Booking: Does not sanitise and escape a settings of its Calendar fieldsCVE-2022-1710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.56
- What to do
- Update Appointment Hour Booking to 1.3.56 or newer.
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- Product
- WP-CRM
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022WP Born Babies: Does not sanitise and escape some of its fieldsCVE-2022-1506 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Born Babies
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Born Babies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.