Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,686 results · page 17 of 34

Jan 30, 2018Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.CVE-2018-6397 · Websites & servers · Joomlacalendars · reported by MITREHigh 7.5
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.
Product
Picture Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 30, 2018SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.CVE-2018-6395 · Websites & servers · Joomlacalendars · reported by MITRECritical 9.8
SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.
Product
Visual Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 29, 2018Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.CVE-2018-6008 · Websites & servers · Joomlatag · reported by MITREHigh 7.5
Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.
Product
Jtag Members Directory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 29, 2018CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.CVE-2018-6007 · Other software · Joomsky · reported by MITREHigh 8.8
CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
Product
JS Support Ticket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 24, 2018SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.CVE-2018-5985 · Other software · Livecrm · reported by MITRECritical 9.8
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
Product
Livecrm Saas Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 24, 2018SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI.CVE-2018-5984 · Other software · Tumder Project · reported by MITRECritical 9.8
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI.
Product
Tumder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 13, 2018The iJoomla com_adagency plugin 6.0.9 for Joomla! allows SQL injection via the `advertiser_status` and `status_select` parameters to index.php.CVE-2018-5696 · Other software · Ijoomla · reported by MITRECritical 9.8
The iJoomla com_adagency plugin 6.0.9 for Joomla! allows SQL injection via the `advertiser_status` and `status_select` parameters to index.php.
Product
AD Agency
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 8, 2018The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.CVE-2018-5263 · Other software · Stackideas · reported by MITREMedium 5.4
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
Product
Easydiscuss
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stackideas.com exploit-db.com
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remoCVE-2015-7324 · Other software · Stackideas · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.
Product
Komento
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org stackideas.com
Dec 27, 2017The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.CVE-2017-17875 · Other software · Jextn · reported by MITRECritical 9.8
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
Product
Jextn FAQ Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 27, 2017The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.CVE-2017-17872 · Other software · Jextn · reported by MITRECritical 9.8
The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.
Product
Jextn Video Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 27, 2017The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter.CVE-2017-17871 · Other software · Jextn · reported by MITRECritical 9.8
The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter.
Product
Jextn Question And Answer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Dec 27, 2017The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.CVE-2017-17870 · Other software · Jbuildozer · reported by MITRECritical 9.8
The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.
Product
Jbuildozer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vel.joomla.org exploit-db.com
Nov 9, 2017In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.CVE-2017-16634 · Websites & servers · Joomla · reported by MITRECritical 9.8
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 9, 2017In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.CVE-2017-16633 · Websites & servers · Joomla · reported by MITREMedium 4.3
In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 29, 2017The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.CVE-2017-15966 · Other software · ZH Yandexmap Project · reported by MITRECritical 9.8
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.
Product
ZH Yandexmap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Oct 29, 2017The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.CVE-2017-15965 · Other software · Nswd · reported by MITRECritical 9.8
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.
Product
NS Download Shop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Oct 27, 2017In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php.CVE-2017-15946 · Other software · Selfget · reported by MITRECritical 9.8
In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.
Product
TAG Meta
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com vulnerability-lab.com
Oct 18, 2017Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authenticCVE-2015-7715 · Other software · Realtyna · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.
Product
Realtyna Property Listing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com rpl.realtyna.com
Oct 18, 2017Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL comCVE-2015-7714 · Other software · Realtyna · reported by MITREHigh 7.2
Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php.
Product
Realtyna Property Listing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com rpl.realtyna.com
Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14845 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.CVE-2017-14842 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.CVE-2017-14841 · Other software · Dasinfomedia · reported by MITREMedium 6.5
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.
Product
Annual Maintenance Contract Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 27, 2017The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of serviceCVE-2014-9686 · Other software · Mapsplugin · reported by MITREMedium 5.9
The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service via the 'url' parameter to plugin_googlemap3_kmlprxy.php. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7428.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org websecurity.com.ua
Sep 20, 2017In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.CVE-2017-14596 · Websites & servers · Joomla · reported by MITRECritical 9.8
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 20, 2017In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.CVE-2017-14595 · Websites & servers · Joomla · reported by MITRELow 3.7
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 20, 2017Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.CVE-2015-5608 · Websites & servers · Joomla · reported by MITREMedium 6.1
Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com developer.joomla.org
Sep 20, 2017The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.CVE-2015-4075 · Other software · Helpdeskpro · reported by MITREHigh 8.1
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
Product
Helpdesk Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 20, 2017Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a ..CVE-2015-4074 · Other software · Helpdesk Pro Project · reported by MITREHigh 7.5
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Product
Helpdesk Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 20, 2017Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) CVE-2015-4073 · Other software · Helpdesk Pro Project · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Product
Helpdesk Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 20, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script orCVE-2015-4072 · Other software · Helpdesk Pro Project · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
Product
Helpdesk Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Sep 14, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.CVE-2013-7429 · Other software · Mapsplugin · reported by MITRECritical 9.8
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org mapsplugin.com
Sep 8, 2017Vulnerability in Easy Joomla Backup v3.2.4.CVE-2017-2550 · Other software · kubik-rubik · reported by larry0@me.comHigh 7.5
Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.
Product
Easy Joomla Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vapidlabs.com vapidlabs.com
Sep 7, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.CVE-2013-7428 · Other software · Mapsplugin · reported by MITREHigh 7.5
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org mapsplugin.com
Aug 29, 2017Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-7433 · Other software · Mapsplugin · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 29, 2017The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.CVE-2013-7432 · Other software · Mapsplugin · reported by MITREHigh 7.5
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 29, 2017Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-7431 · Other software · Mapsplugin · reported by MITREMedium 5.3
Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityvulns.ru mapsplugin.com
Aug 28, 2017Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the CVE-2013-7430 · Other software · Mapsplugin · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter.
Product
Googlemaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mapsplugin.com openwall.com
Aug 18, 2017The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and nCVE-2015-4071 · Other software · Helpdesk Pro Project · reported by MITREMedium 5.3
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
Product
Helpdesk Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2017The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the targeCVE-2017-11364 · Websites & servers · Joomla · reported by MITREHigh 8.8
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com developer.joomla.org
Jul 26, 2017In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.CVE-2017-11612 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com developer.joomla.org
Jul 25, 2017SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2015-2798 · Other software · Web-dorado · reported by MITRECritical 9.8
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Contact Form Maker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Jul 17, 2017Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.CVE-2017-9934 · Websites & servers · Joomla · reported by MITREMedium 6.1
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jul 17, 2017Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents.CVE-2017-9933 · Websites & servers · Joomla · reported by MITREHigh 7.5
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 29, 2017The VirtueMart com_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemart_paymentmethod_id or viCVE-2016-10379 · Other software · Virtuemart · reported by MITREHigh 7.2
The VirtueMart com_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemart_paymentmethod_id or virtuemart_shipmentmethod_id parameter to administrator/index.php.
Product
Virtuemart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code610.blogspot.com securityfocus.com
May 17, 2017SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2017-8917 · Websites & servers · Joomla · reported by MITRECritical 9.8
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.