Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,520 results · page 16 of 31
Jun 16, 2023Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.CVE-2023-2792 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 12, 2023Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with aCVE-2023-1897 · Other software · Atlas Copco · reported by ics-cert@hq.dhs.govCritical 9.4
Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller.
- Product
- Power Focus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023The filename parameter of the Context.FileAttachment function is not properly sanitized.CVE-2023-29401 · Other software · github.com/gin-gonic/gin · reported by security@golang.orgMedium 4.3
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
- Product
- github.com/gin-gonic/gin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paCVE-2023-34409 · Other software · Percona · reported by MITRECritical 9.8
In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.
- Product
- Monitoring And Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpercona.compercona.com
Jun 6, 2023A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0.CVE-2023-31606 · Other software · Promptworks · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- Product
- Redcloth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands tCVE-2023-23599 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 30, 2023Add to Feedly: Does not sanitize and escape its settingsCVE-2023-2470 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Add to Feedly
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Add to Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
May 30, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some URL parametersCVE-2023-2256 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.7
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.7 or newer.
May 30, 2023Image Optimizer by 10web: Does not sanitize the dir parameterCVE-2023-2117 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
- Product
- Elementor Website Builder
- Fixed in
- 3.12.2
- What to do
- Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.6
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
- Product
- RapidExpCart
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 3, 2023In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's daCVE-2022-47757 · Other software · IMO · reported by MITRECritical 9.8
In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.
- Product
- IMO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue afCVE-2023-1384 · Other software · Amazon · reported by cve-requests@bitdefender.comMedium 4.3
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.
- Product
- Fire TV Stick 3rd gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
May 2, 2023Limit Login Attempts: Does not sanitize and escape usernamesCVE-2023-1861 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Limit Login Attempts
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2023The file download facility doesn't sufficiently sanitize file paths in certain situations.CVE-2023-31250 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to preveCVE-2022-25277 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.2
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flowsCVE-2023-2273 · Other software · Rapid7 · reported by cve@rapid7.comMedium 5.8
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal.
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Apr 25, 2023When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients.CVE-2023-2281 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 24, 2023Random Text: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2023-0388 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.
- Product
- Random Text
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Random Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 21, 2023In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input.CVE-2023-26100 · Other software · Progress · reported by MITREMedium 6.1
In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser.
- Product
- Flowmon OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kemptechnologies.comflowmon.com
Apr 19, 2023In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permission check.CVE-2023-21094 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-248031255
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 10, 2023Klaviyo: Does not sanitize and escape some of its settingsCVE-2023-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Klaviyo
- Fixed in
- 3.0.10
- What to do
- Update Klaviyo to 3.0.10 or newer.
Apr 10, 2023Contact Form: Does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field typeCVE-2023-0546 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.
- Product
- Contact Form
- Fixed in
- 4.3.25
- What to do
- Update Contact Form to 4.3.25 or newer.
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
- Product
- Article Directory
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2023BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem.CVE-2023-29478 · Other software · Bibliocraftmod · reported by MITRECritical 9.8
BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution.
- Product
- Bibliocraft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1758 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payloCVE-2022-38923 · Other software · Iss-oberlausitz · reported by MITRECritical 9.8
BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payload.
- Product
- Bluepage CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combluepage-cms.com
Apr 3, 2023BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-CVE-2022-38922 · Other software · Iss-oberlausitz · reported by MITRECritical 9.8
BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload.
- Product
- Bluepage CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combluepage-cms.com
Mar 31, 2023When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadingCVE-2023-1775 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 28, 2023Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user.CVE-2023-28648 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 7.5
Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023WP Dark Mode: Does not properly sanitize the style parameter in shortcodes before using it to load a PHP templateCVE-2023-0467 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
- Product
- WP Dark Mode
- Fixed in
- 4.0.8
- What to do
- Update WP Dark Mode to 4.0.8 or newer.
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 13, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0844 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Namaste! LMS
- Fixed in
- 2.6
- What to do
- Update Namaste! LMS to 2.6 or newer.
Mar 13, 2023FluentSMTP: Does not sanitize or escape email contentCVE-2023-0219 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
- Product
- FluentSMTP
- Fixed in
- 2.2.3
- What to do
- Update FluentSMTP to 2.2.3 or newer.
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
- Product
- Resume Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0548 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Namaste! LMS
- Fixed in
- 2.5.9.4
- What to do
- Update Namaste! LMS to 2.5.9.4 or newer.
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Arigato Autoresponder and Newsletter
- Fixed in
- 2.1.7.2
- What to do
- Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Feb 24, 2023sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.CVE-2022-48345 · Other software · Paypal · reported by MITREMedium 6.1
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
- Product
- Braintree/sanitize-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Spectra: Does not sanitize user inputCVE-2020-36656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.
- Product
- Spectra
- Fixed in
- 1.15.0
- What to do
- Update Spectra to 1.15.0 or newer.
Feb 20, 2023The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL.CVE-2023-26265 · Other software · Borg Project · reported by MITREMedium 5.3
The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in the file template.php does not properly sanitize incoming path arguments before using them.
- Product
- Borg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackdropcms.orggithub.com
Feb 16, 2023NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input.CVE-2023-0861 · Other software · NetModule · reported by research@onekey.comHigh 7.2
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
- Product
- NSRW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonekey.comshare.netmodule.com
Feb 15, 2023Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template renCVE-2023-25764 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
- Product
- Jenkins Email Extension Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 6, 2023YourChannel: Does not sanitize and escape some parametersCVE-2023-0282 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
- Product
- YourChannel
- Fixed in
- 1.2.2
- What to do
- Update YourChannel to 1.2.2 or newer.
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
- Product
- SiteGround Security
- Fixed in
- 1.3.1
- What to do
- Update SiteGround Security to 1.3.1 or newer.
Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Hide My WP
- Fixed in
- 6.2.9
- What to do
- Update Hide My WP to 6.2.9 or newer.
Jan 30, 2023Panda Pods Repeater Field: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
- Product
- Panda Pods Repeater Field
- Fixed in
- 1.5.4
- What to do
- Update Panda Pods Repeater Field to 1.5.4 or newer.
Jan 27, 2023Sanitize is an allowlist-based HTML and CSS sanitizer.CVE-2023-23627 · Other software · rgrove · reported by GitHubMedium 6.1
Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.
- Product
- sanitize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.