Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,911 results · page 16 of 39
Jun 16, 2022A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel.CVE-2021-41421 · Other software · Maianmedia · reported by MITREMedium 4.8
A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel.
- Product
- Maianaffiliate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commaianaffiliate.com
Jun 6, 2022FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.CVE-2022-30863 · Other software · Fudforum · reported by MITREMedium 4.8
FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.CVE-2022-30860 · Other software · Fudforum · reported by MITREHigh 7.2
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user.CVE-2021-44096 · Other software · Egavilanmedia · reported by MITRECritical 9.8
EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote attacker to compromise Application SQL database.
- Product
- User Registration And Login System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.CVE-2022-29380 · Other software · Creativeitem · reported by MITREMedium 4.8
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 19, 2022An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if conteCVE-2022-30618 · Other software · Strapi · reported by disclosure@synopsys.comHigh 7.5
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
May 19, 2022An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel CVE-2022-30617 · Other software · Strapi · reported by disclosure@synopsys.comHigh 8.8
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackersCVE-2022-29009 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.
- Product
- Cyber Cafe Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers toCVE-2022-29007 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypasCVE-2022-29006 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.
- Product
- Directory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parCVE-2022-28078 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameCVE-2022-28077 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-28102 · Websites & servers · PHP Mysql Admin Panel Generator Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php.
- Product
- PHP Mysql Admin Panel Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 12, 2022RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel.CVE-2022-24248 · Other software · Ritecms · reported by MITREMedium 6.5
RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.0day.todayexploit-db.com
Apr 12, 2022RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel.CVE-2022-24247 · Other software · Ritecms · reported by MITREMedium 6.5
RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write) resulting a remote code execution.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexploit-db.com
Apr 8, 2022RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel.CVE-2021-46367 · Other software · Ritecms · reported by MITREHigh 7.2
RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.compacketstormsecurity.com
Apr 8, 2022AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel.CVE-2022-27061 · Other software · Aerocms Project · reported by MITREHigh 7.2
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Aerocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 7, 2022A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.CVE-2021-43432 · Other software · Exrick · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
- Product
- Xmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) PostCVE-2021-34257 · Other software · Wpanel CMS Project · reported by MITREHigh 8.8
Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
- Product
- Wpanel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlatestpcsolution.wordpress.com
Mar 27, 2022aaPanel v6.8.21 was discovered to be vulnerable to directory traversal.CVE-2022-26252 · Other software · Aapanel · reported by MITREMedium 6.5
aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).
- Product
- Aapanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 19, 2022A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.CVE-2022-27226 · Other software · IRZ · reported by MITREHigh 8.8
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
- Product
- Ru21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comen.irz.ru
Mar 18, 2022The GSMA authentication panel could be presented on the lock screen.CVE-2022-22652 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
The GSMA authentication panel could be presented on the lock screen. The issue was resolved by requiring device unlock to interact with the GSMA authentication panel. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access may be able to view and modify the carrier account information and settings from the lock screen.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 9, 2022A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door.CVE-2021-22783 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.8
A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: Ritto Wiser Door (All versions)
- Product
- Ritto Wiser Door
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 4, 2022Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.CVE-2020-18325 · Other software · Intelliants · reported by MITREMedium 6.1
Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php.CVE-2022-25409 · Other software · Hospital Management System Project · reported by MITREMedium 5.4
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php.CVE-2022-25408 · Other software · Hospital Management System Project · reported by MITREMedium 5.4
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.CVE-2022-25407 · Other software · Hospital Management System Project · reported by MITREMedium 5.4
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel.CVE-2021-45007 · Websites & servers · Plesk · reported by MITREMedium 6.5
Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
- Product
- Plesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection.CVE-2020-8242 · Other software · Expressionengine · reported by support@hackerone.comHigh 7.2
Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack.
- Product
- Expressionengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 11, 2022Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.CVE-2022-24001 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.8
Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 11, 2022Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if CVE-2020-36062 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
- Product
- Dairy Farm Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Feb 10, 2022A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore applicatCVE-2022-23321 · Other software · Xerox · reported by MITREMedium 4.8
A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.
- Product
- Xmpie Ustore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtriaxiomsecurity.comxmpie.com
Jan 31, 2022Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromCVE-2020-36064 · Other software · Online Course Registration Project · reported by MITRECritical 9.8
Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
- Product
- Online Course Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectworlds.in
Jan 13, 2022jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.CVE-2021-45806 · Other software · Jpress · reported by MITREHigh 8.8
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.
- Product
- Jpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.CVE-2021-46072 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.CVE-2021-46071 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.CVE-2021-46070 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.CVE-2021-46069 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.CVE-2021-46068 · Other software · Vehicle Service Management System Project · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.CVE-2021-45745 · Other software · Bludit · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.CVE-2021-45744 · Other software · Bludit · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free.CVE-2021-1042 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187851056References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 2, 2021SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php.CVE-2021-43681 · Other software · Zerodream · reported by MITREMedium 6.1
SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data['proxy_name'].
- Product
- Sakurapanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.CVE-2021-43693 · Other software · Vestacp · reported by MITRECritical 9.8
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
- Product
- Vesta Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.CVE-2021-41273 · Other software · pterodactyl · reported by GitHubMedium 4.3
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI.CVE-2021-43574 · Other software · Atmail · reported by MITREMedium 6.1
WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Atmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.atmail.commedium.com
Nov 9, 2021An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14.CVE-2021-37158 · Other software · Opengamepanel · reported by MITREHigh 8.8
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike server and using the map field to enter a Bash command.
- Product
- Opengamepanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 9, 2021An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14.CVE-2021-37157 · Other software · Opengamepanel · reported by MITREHigh 8.8
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.
- Product
- Opengamepanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.