Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,145 results · page 14 of 23

Dec 20, 2023SEO Change Monitor – Track Website Changes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33209 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.
Product
SEO Change Monitor – Track Website Changes
Affected
up to 1.2
What to do
Affects up to 1.2. Update SEO Change Monitor – Track Website Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-38519 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.4.3.3
What to do
Affects up to 4.4.3.3. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports.CVE-2023-32725 · Other software · Zabbix · reported by security@zabbix.comCritical 9.6
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zabbix.com support.zabbix.com
Dec 15, 2023TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions.CVE-2023-48387 · Other software · TAIWAN-CA(TWCA) · reported by twcert@cert.org.twHigh 8.8
TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.
Product
JCICSecurityTool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 14, 2023A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v.CVE-2023-48049 · Other software · Cybrosys · reported by MITRECritical 9.8
A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.
Product
Website Blog Search
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 4, 2023Vite is a website frontend framework.CVE-2023-49293 · Other software · vitejs · reported by GitHubMedium 6.1
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.
Product
vite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 27, 2023OroCommerce package with customer portal and non authenticated visitor website base features.CVE-2023-32064 · Websites & servers · oroinc · reported by GitHubMedium 5
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.
Product
orocommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 22, 2023MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: CSS InjectionCVE-2023-6164 · WordPress plugins & themes · reported by WordfenceLow 2.2
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.5.1.2
What to do
Affects up to 4.5.1.2. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Website Optimization – Plerdy: Stored Cross-Site ScriptingCVE-2023-5715 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Website Optimization – Plerdy
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Website Optimization – Plerdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.CVE-2023-27633 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.
Affected
up to 2.10.4
What to do
Affects up to 2.10.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).CVE-2023-48176 · Other software · Mizhexiaoxiao · reported by MITRECritical 9.8
An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).
Product
Websiteguide
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record prairie-steed-4d7.notion.site prairie-steed-4d7.notion.site
Nov 14, 2023Statamic is a flat-first, Laravel + Git powered CMS designed for building websites.CVE-2023-48217 · Other software · statamic · reported by GitHubHigh 8.8
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions.CVE-2023-26543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions.
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 1, 2023Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker CVE-2023-4197 · Other software · Dolibarr · reported by info@starlabs.sgHigh 7.5
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
Product
Dolibarr ERP CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com starlabs.sg
Oct 30, 2023baserCMS is a website development framework.CVE-2023-43792 · Other software · baserproject · reported by GitHubCritical 9.8
baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basercms.net github.com
Oct 30, 2023baserCMS is a website development framework.CVE-2023-43649 · Other software · baserproject · reported by GitHubMedium 4.7
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basercms.net github.com
Oct 30, 2023baserCMS is a website development framework.CVE-2023-43648 · Other software · baserproject · reported by GitHubMedium 4.9
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basercms.net github.com
Oct 30, 2023baserCMS is a website development framework.CVE-2023-43647 · Other software · baserproject · reported by GitHubMedium 6.1
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basercms.net github.com
Oct 27, 2023baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4.CVE-2023-29009 · Other software · baserproject · reported by GitHubMedium 6.1
baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.
Product
basercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basercms.net github.com
Oct 25, 2023A website could have obscured the full screen notification by using the file open dialog.CVE-2023-5726 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 25, 2023Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerabiCVE-2023-46659 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Product
Jenkins Edgewall Trac Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Oct 21, 2023Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footCVE-2023-46054 · Other software · Wbce · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.
Product
Wbce CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 20, 2023Website Builder by SeedProd: Cross-Site Request ForgeryCVE-2023-4975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Website Builder by SeedProd
Affected
up to 6.15.13.1
What to do
Affects up to 6.15.13.1. Update Website Builder by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2023A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scriptsCVE-2023-43232 · Other software · Dedebiz · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
Product
Dedebiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com dedebiz.com
Sep 20, 2023The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacCVE-2022-47561 · Other software · Ormazabal · reported by cve-coordination@incibe.esHigh 7.3
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.
Product
ekorCCP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Sep 16, 2023A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical.CVE-2023-5014 · Other software · Sakshi2610 · reported by VulDBMedium 6.3
A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfood.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239855.
Product
Food Ordering Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Sep 14, 2023A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter inCVE-2023-40956 · Other software · Cloudroits · reported by MITREHigh 8.8
A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter in controllers/main.py component.
Product
Wesite JOB Search
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 14, 2023Elementor Website Builder: Does not filter out user-controlled URLs from being loaded into the DOMCVE-2022-4953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Product
Elementor Website Builder
Fixed in
3.5.5
What to do
Update Elementor Website Builder to 3.5.5 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 6, 2023Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms aCVE-2023-37581 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.
Product
Apache Roller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Aug 1, 2023A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL.CVE-2023-4053 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 1, 2023A website could have obscured the full screen notification by using the file open dialog.CVE-2023-4051 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 24, 2023An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section.CVE-2022-28867 · Other software · Nokia · reported by MITREMedium 5.4
An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.
Product
Netact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it telecomitalia.com
Jul 24, 2023An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section.CVE-2022-28865 · Other software · Nokia · reported by MITREMedium 5.4
An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
Product
Netact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it telecomitalia.com
Jul 24, 2023An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section.CVE-2022-28864 · Other software · Nokia · reported by MITREHigh 8.8
An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.
Product
Netact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it telecomitalia.com
Jul 21, 2023An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.CVE-2023-36339 · Other software · Webboss · reported by MITREHigh 7.5
An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
Product
Webboss.io CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webboss.feedbear.com realinfosec.net
Jul 19, 2023Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.CVE-2023-37362 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.2
Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.
Product
Weincloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jul 12, 2023A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic.CVE-2023-3642 · Other software · GZ Scripts · reported by VulDBMedium 4.3
A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of the argument username/title/comment leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233888.
Product
Vacation Rental Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Jul 11, 2023WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.CVE-2023-37656 · Other software · Websiteguide Project · reported by MITRECritical 9.8
WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.
Product
Websiteguide
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.CVE-2023-22673 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.
Affected
up to 1.0.29.1
What to do
Affects up to 1.0.29.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2023A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts orCVE-2023-37136 · Other software · Eyoucms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Product
Eyoucms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 5, 2023MechanicalSoup is a Python library for automating interaction with websites.CVE-2023-34457 · Other software · MechanicalSoup · reported by GitHubMedium 5.9
MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.
Product
MechanicalSoup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 5, 2023A website could prevent a user from exiting full-screen mode via alert and prompt calls.CVE-2023-37210 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 5, 2023Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website.CVE-2023-37206 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 5, 2023A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function.CVE-2023-37204 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jul 5, 2023A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.CVE-2023-37207 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Jul 3, 2023`tktchurch/website` contains the codebase for The King's Temple Church website.CVE-2023-36817 · Other software · tktchurch · reported by GitHubHigh 7.5
`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase.
Product
website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2023Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by aCVE-2023-2793 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 6, 2023Elementor Website Builder: Stored Cross-Site ScriptingCVE-2020-36703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Product
Elementor Website Builder
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 2, 2023A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assiCVE-2023-29533 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org bugzilla.mozilla.org
Jun 2, 2023Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks.CVE-2023-28164 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.