Updated 14 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,686 results · page 16 of 34

Feb 22, 2018SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.CVE-2018-7313 · Other software · Cwjoomla · reported by MITRECritical 9.8
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
Product
CW Tags
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 18, 2018SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.CVE-2018-6024 · Other software · Thethinkery · reported by MITRECritical 9.8
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
Product
Project LOG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.CVE-2018-7180 · Other software · Saxum2003 · reported by MITRECritical 9.8
SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.
Product
Astro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.CVE-2018-7179 · Other software · Squadmanagement Project · reported by MITRECritical 9.8
SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.
Product
Squadmanagement
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.CVE-2018-7178 · Other software · Saxum2003 · reported by MITRECritical 9.8
SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.
Product
Saxum Picker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.CVE-2018-7177 · Other software · Saxum2003 · reported by MITRECritical 9.8
SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.
Product
Numerology
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.CVE-2018-6585 · Other software · Techjoomla · reported by MITRECritical 9.8
SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.
Product
Jticketing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.CVE-2018-6584 · Other software · Dthdevelopment · reported by MITRECritical 9.8
SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.
Product
DT Register
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.CVE-2018-6583 · Other software · Quanticalabs · reported by MITRECritical 9.8
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
Product
Timetable Responsive Schedule
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map paCVE-2018-6396 · Computers, phones & browsers · Google MAP Landkarten Project · reported by MITRECritical 9.8
SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map parameter in a layout=default action.
Product
Google MAP Landkarten
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Feb 17, 2018SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.CVE-2018-6394 · Other software · Techjoomla · reported by MITRECritical 9.8
SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.
Product
Invitex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.CVE-2018-6373 · Other software · Fastballproductions · reported by MITRECritical 9.8
SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.
Product
Fastball
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.CVE-2018-6372 · Other software · Joombooking · reported by MITRECritical 9.8
SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.
Product
JB BUS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI.CVE-2018-6370 · Other software · Neojoomla · reported by MITRECritical 9.8
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI.
Product
Neorecruit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action.CVE-2018-6368 · Other software · Comdev · reported by MITRECritical 9.8
SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action.
Product
Jomestate Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.CVE-2018-6006 · Other software · Joomsky · reported by MITRECritical 9.8
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
Product
JS Autoz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.CVE-2018-6005 · Other software · Realpin Project · reported by MITRECritical 9.8
SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
Product
Realpin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.CVE-2018-6004 · Other software · Techsolsystem · reported by MITRECritical 9.8
SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
Product
File Download Tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume requestCVE-2018-5994 · Other software · Joomsky · reported by MITRECritical 9.8
SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request.
Product
JS Jobs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.CVE-2018-5993 · Other software · Aist Project · reported by MITRECritical 9.8
SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.
Product
Aist
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.CVE-2018-5992 · Other software · Staff Master Project · reported by MITRECritical 9.8
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.
Product
Staff Master
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVCVE-2018-5991 · Other software · Web-dorado · reported by MITRECritical 9.8
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.
Product
Form Maker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.CVE-2018-5990 · Other software · Allvideos Reloaded Project · reported by MITRECritical 9.8
SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.
Product
Allvideos Reloaded
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.CVE-2018-5989 · Other software · Chillcreations · reported by MITRECritical 9.8
SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.
Product
Ccnewsletter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the endsCVE-2018-5987 · Other software · Social Pinboard Project · reported by MITRECritical 9.8
SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.
Product
Social Pinboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.CVE-2018-5983 · Other software · Jquickcontact Project · reported by MITRECritical 9.8
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
Product
Jquickcontact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.CVE-2018-5982 · Other software · Ordasoft · reported by MITRECritical 9.8
SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.
Product
Advertisement Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.CVE-2018-5981 · Other software · Web-dorado · reported by MITRECritical 9.8
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
Product
Gallery WD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.CVE-2018-5980 · Other software · Solidres · reported by MITRECritical 9.8
SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.
Product
Solidres
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.CVE-2018-5975 · Other software · Thekrotek · reported by MITRECritical 9.8
SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.
Product
Smart Shoutbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.CVE-2018-5974 · Other software · Albonico · reported by MITRECritical 9.8
SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.
Product
Simplecalendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter.CVE-2018-5971 · Other software · Ordasoft · reported by MITRECritical 9.8
SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter.
Product
Medialibrary
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 17, 2018SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter.CVE-2018-5970 · Other software · Techjoomla · reported by MITRECritical 9.8
SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter.
Product
Jgive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 6, 2018Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitraCVE-2015-3619 · Other software · Virtuemart · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company."
Product
Virtuemart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.virtuemart.net fortiguard.com
Feb 5, 2018Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.CVE-2018-6610 · Other software · Jlike Project · reported by MITREHigh 7.5
Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.
Product
Jlike
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 5, 2018SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist CVE-2018-6609 · Other software · JSP Tickets Project · reported by MITRECritical 9.8
SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action.
Product
JSP Tickets
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 5, 2018SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, orCVE-2018-6605 · Other software · ZH Baidumap Project · reported by MITRECritical 9.8
SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
Product
ZH Baidumap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 5, 2018SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.CVE-2018-6604 · Other software · ZH Yandexmap Project · reported by MITRECritical 9.8
SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.
Product
ZH Yandexmap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 5, 2018SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, oCVE-2018-6582 · Other software · ZH Googlemap Project · reported by MITRECritical 9.8
SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
Product
ZH Googlemap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.CVE-2018-6581 · Other software · Joommasters · reported by MITRECritical 9.8
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.
Product
JMS Music
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component request.CVE-2018-6580 · Other software · Janguo · reported by MITRECritical 9.8
Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component request.
Product
Jimtawl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.CVE-2018-6579 · Other software · Jextn · reported by MITRECritical 9.8
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
Product
Reverse Auction
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.CVE-2018-6578 · Other software · Jextn · reported by MITRECritical 9.8
SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
Product
JE Paypervideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.CVE-2018-6577 · Other software · Jextn · reported by MITRECritical 9.8
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
Product
Membership
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2018SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.CVE-2018-6575 · Other software · Jextn · reported by MITRECritical 9.8
SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
Product
Classified
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 30, 2018In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.CVE-2018-6380 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 30, 2018In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.CVE-2018-6379 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 30, 2018In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkboxCVE-2018-6377 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 30, 2018In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.CVE-2018-6376 · Websites & servers · Joomla · reported by MITRECritical 9.8
In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 30, 2018SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.CVE-2018-6398 · Websites & servers · Joomlacalendars · reported by MITRECritical 9.8
SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.
Product
Event Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.