Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,479 results · page 14 of 30
Dec 20, 2018SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitraCVE-2018-18399 · Other software · JCO · reported by MITRECritical 9.8
SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
- Product
- Karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Dec 19, 2018Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected intCVE-2018-20300 · Other software · Phome · reported by MITRECritical 9.8
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordp0desta.comp0desta.com
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002009 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002008 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002007 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002004 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002003 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002002 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to explCVE-2018-1002001 · WordPress plugins & themes · reported by larry0@me.comMedium 4.8
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Dec 3, 2018There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit.CVE-2018-1002000 · WordPress plugins & themes · reported by larry0@me.comHigh 7.2
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.
- Affected
- 2.5.1.8 to 2.5.1.8
- What to do
- Affects 2.5.1.8 to 2.5.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Nov 26, 2018JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.CVE-2018-19544 · Other software · Jeecms · reported by MITREMedium 6.5
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.
- Product
- Jeecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).CVE-2018-18887 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 18, 2018The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code inCVE-2018-18461 · WordPress plugins & themes · reported by MITRECritical 9.8
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.
- Affected
- 2.5.1.7 to 2.5.1.7
- What to do
- Affects 2.5.1.7 to 2.5.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Oct 12, 2018XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.CVE-2018-18271 · Other software · Cmsmadesimple · reported by MITREMedium 6.1
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2018XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.CVE-2018-18270 · Other software · Cmsmadesimple · reported by MITREMedium 6.1
XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2018The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item.CVE-2018-15677 · Other software · Btiteam · reported by MITREMedium 6.1
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Aug 7, 2018In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.CVE-2018-15177 · Other software · Gxlcms · reported by MITREHigh 8.8
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.
- Product
- Gxlcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that canCVE-2018-1000515 · Other software · News-articles Project · reported by MITREHigh 7.5
ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that can result in Attacker can read any file in the server or use smbrelay attack to access to server..
- Product
- News-articles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jun 26, 2018Email Subscribers & Newsletters versions prior to 3.5.0: Cross-site scriptingCVE-2018-0602 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Email Subscribers & Newsletters versions prior to 3.5.0
- Fixed in
- 3.5.0
- What to do
- Update Email Subscribers & Newsletters versions prior to 3.5.0 to 3.5.0 or newer.
Jun 11, 2018Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parCVE-2018-12094 · Other software · Dimofinf · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- Product
- Dimofinf CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexploit-db.com
May 26, 2018PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.CVE-2018-11487 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2018YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).CVE-2018-9993 · Other software · Yunucms · reported by MITREMedium 4.8
YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).
- Product
- Yunucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.CVE-2018-6868 · Other software · Groupon Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
- Product
- Groupon Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 17, 2018SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.CVE-2018-5989 · Other software · Chillcreations · reported by MITRECritical 9.8
SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.
- Product
- Ccnewsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 13, 2018PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.CVE-2018-6928 · Other software · News Website Script Project · reported by MITRECritical 9.8
PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.
- Product
- News Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 26, 2018An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.CVE-2018-6015 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
- Product
- An issue was discovered in the "Email Subscribers & Newsletters
- Fixed in
- 3.4.8
- What to do
- Update An issue was discovered in the "Email Subscribers & Newsletters to 3.4.8 or newer.
Full record and what to do →NVD recordblog.threatpress.comwordpress.org
Jan 13, 2018NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php.CVE-2018-5687 · Other software · Newsbee Project · reported by MITREMedium 4.8
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php.
- Product
- Newsbee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2018SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands.CVE-2017-5971 · Other software · Newsbee Project · reported by MITRECritical 9.8
SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands.
- Product
- Newsbee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.CVE-2018-5076 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2018The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameCVE-2017-18010 · WordPress plugins & themes · reported by MITREMedium 6.1
The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.
- Product
- E-goi Smart Marketing SMS and Newsletters Forms
- Fixed in
- 2.0.0
- What to do
- Update E-goi Smart Marketing SMS and Newsletters Forms to 2.0.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Dec 30, 2017PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.CVE-2017-12810 · Other software · Stivasoft · reported by MITREMedium 6.1
PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
- Product
- Phpjabbers Newsletter Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Dec 27, 2017In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data CVE-2017-17912 · Other software · Graphicsmagick · reported by MITREHigh 8.8
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- Product
- Graphicsmagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.graphicsmagick.orglists.debian.org
Dec 14, 2017examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mighCVE-2017-17532 · Other software · Kiwi Project · reported by MITREHigh 8.8
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Dec 13, 2017MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.CVE-2017-17636 · Other software · MLM Forced Matrix Project · reported by MITRECritical 9.8
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
- Product
- MLM Forced Matrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.CVE-2017-17635 · Other software · MLM Forex Market Plan Script Project · reported by MITRECritical 9.8
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
- Product
- MLM Forex Market Plan Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.CVE-2017-17610 · Websites & servers · E-commerce MLM Software Project · reported by MITRECritical 9.8
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.
- Product
- E-commerce MLM Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.CVE-2017-17607 · Other software · CMS Auditor Website Project · reported by MITRECritical 9.8
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
- Product
- CMS Auditor Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.CVE-2017-17578 · Other software · Crowdfunding Script Project · reported by MITRECritical 9.8
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
- Product
- Crowdfunding Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 31, 2017Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.CVE-2017-15982 · Other software · Geniusocean · reported by MITRECritical 9.8
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
- Product
- News
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 31, 2017Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.CVE-2017-15981 · Other software · Geniusocean · reported by MITRECritical 9.8
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
- Product
- Newspaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 29, 2017PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.CVE-2017-15970 · Websites & servers · Phpcityportal · reported by MITRECritical 9.8
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
- Product
- Phpcityportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 26, 2017SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.pCVE-2017-15907 · Websites & servers · Phpcollab · reported by MITRECritical 9.8
SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.php.
- Product
- Phpcollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsstrunk.comsstrunk.com
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.CVE-2017-15732 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2017Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attaCVE-2017-14500 · Other software · Newsbeuter · reported by MITREHigh 8.8
Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.
- Product
- Newsbeuter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdebian.org
Aug 23, 2017Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perfCVE-2017-12904 · Other software · Newsbeuter · reported by MITREHigh 8.8
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
- Product
- Newsbeuter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack ofCVE-2017-9245 · Computers, phones & browsers · Google · reported by MITREHigh 7.5
The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack of SSL.
- Product
- News And Weather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Apr 7, 2017SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands CVE-2017-7581 · Other software · News System Project · reported by MITRECritical 9.8
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
- Product
- News System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordambionics.ioambionics.io
Mar 24, 2017XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter.CVE-2017-7257 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record03i0.comsecurityfocus.com
Mar 24, 2017XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter.CVE-2017-7256 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record03i0.comsecurityfocus.com
Mar 24, 2017XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter.CVE-2017-7255 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record03i0.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.