Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

398 results · page 2 of 8

Jun 17, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).CVE-2026-46812 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
Oracle Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jun 17, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin).CVE-2026-35314 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.3
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Product
Oracle Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jun 17, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).CVE-2026-35313 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Product
Oracle Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jun 17, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).CVE-2026-35261 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Product
Oracle Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jun 15, 2026Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations.CVE-2026-9863 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffHigh 7.5
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
Product
Core Privileged Access Manager (BoKS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortra.com
Jun 15, 2026Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service.CVE-2026-9862 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffCritical 9.8
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
Product
Core Privileged Access Manager (BoKS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortra.com
Jun 12, 2026Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability.CVE-2026-45169 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17
Product
PAM SH Vault
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cyberark.com docs.cyberark.com
Jun 1, 2026Advanced Access Manager: Authentication Bypass by SpoofingCVE-2026-42674 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue affects Advanced Access Manager: from n/a through 7.1.0.
Product
Advanced Access Manager
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026SQL Injection affecting the Access Manager role.CVE-2026-27768 · Other software · Genetec Inc. · reported by security@genetec.comMedium 6.6
SQL Injection affecting the Access Manager role.
Product
Genetec Security Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record techdocs.genetec.com techdocs.genetec.com
Apr 14, 2026A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8).CVE-2026-27668 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.
Product
RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com
Jan 26, 2026By default, the password for the Access Manager's web interface, is set to 'admin'.CVE-2025-59108 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.2
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network.CVE-2025-59107 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.5
Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges.CVE-2025-59106 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Product
Access Manager 92xx-k7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption.CVE-2025-59105 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable).CVE-2025-59104 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
Product
Access Manager 92xx-k7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions.CVE-2025-59103 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.2
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users with hardcoded and weak passwords that can be used to access the devices via SSH. The passwords can be also guessed very easily. The password of at least one user is set to a random value after the first deployment, with the restriction that the password is only randomized if the configured date is prior to 2022. Therefore, under certain circumstances, the passwords are not randomized. For example, if the clock is never set on the device, the battery of the clock module has been changed, the Access Manager has been factory reset and has not received a time yet.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device.CVE-2025-59102 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.9
The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can easily get access to the backup functionality by abusing the session management issue (CVE-2025-59101), or by exploiting the weak default password (CVE-2025-59108), or by simply setting a new password without prior authentication via the SOAP API (CVE-2025-59097), it is easily possible to access the sensitive data on the device.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in.CVE-2025-59101 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.7
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The web interface offers a functionality to export the internal SQLite database.CVE-2025-59100 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.9
The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes the device does not reboot and therefore the exported database is not deleted, or the device reboots and the export is not deleted for unknown reasons. The path where the database export is located can be accessed without prior authentication. This leads to the fact that an attacker might be able to get access to the exported database without prior authentication. The database includes sensitive data like passwords, card pins, encrypted Mifare sitekeys and much more.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The Access Manager is using the open source web server CompactWebServer written in C#.CVE-2025-59099 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The Access Manager is offering a trace functionality to debug errors and issues with the device.CVE-2025-59098 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.7
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface. The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 26, 2026The exos 9300 application can be used to configure Access Managers (e.g.CVE-2025-59097 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.3
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps. This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication: - Re-configure Access Managers (e.g. remove alarming system requirements) - Freely re-configure the inputs and outputs - Open all connected doors permanently - Open all doors for a defined time interval - Change the admin password - and many more Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure conf
Product
Access Manager 92xx-k5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 13, 2026Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an aCVE-2025-11669 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
Product
ManageEngine PAM360
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com
Dec 16, 2025Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.CVE-2025-13532 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.2
Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
Product
Core Privileged Access Manager (BoKS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortra.com
Jun 17, 2025A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 CVE-2025-5141 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.5
A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache.
Product
Core Privileged Access Manager (BoKS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortra.com
Feb 3, 2025PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping.CVE-2024-57967 · Other software · CyberArk · reported by MITREMedium 4.2
PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping.
Product
Privileged Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cyberark.com cyberark.com
Feb 3, 2025PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute CVE-2024-54840 · Other software · CyberArk · reported by MITREMedium 4.2
PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.
Product
Privileged Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cyberark.com gist.github.com
Jan 13, 2025Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php.CVE-2023-42250 · Other software · Seling · reported by MITREMedium 6.1
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php.CVE-2023-42249 · Other software · Seling · reported by MITREMedium 6.1
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42248 · Other software · Seling · reported by MITREMedium 6.5
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php".
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php.CVE-2023-42247 · Other software · Seling · reported by MITREMedium 6.1
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php.CVE-2023-42246 · Other software · Seling · reported by MITREMedium 6.1
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php.CVE-2023-42245 · Other software · Seling · reported by MITREMedium 6.1
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42244 · Other software · Seling · reported by MITREHigh 8.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_visits.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries.CVE-2023-42243 · Other software · Seling · reported by MITREMedium 5.4
In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42242 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/s_terminal.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42241 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_anagraphic.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42240 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/s_scheduledfile.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42239 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_ep.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42238 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_eps.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42237 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vam_i_command.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42236 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Jan 13, 2025An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.CVE-2023-42235 · Other software · Seling · reported by MITRELow 3.8
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/s_normalizedtrans.php.
Product
Visual Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Dec 19, 2024In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication CVE-2024-12111 · Other software · OpenText · reported by security@opentext.comHigh 8
In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication bypass. This issue affects Privileged Access Manager version 23.3(4.4); 24.3(4.5)
Product
Privileged Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netiq.com netiq.com
Nov 1, 2024User Rights Access Manager: Access ControlCVE-2024-37209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Access Control vulnerability in Prism IT Systems User Rights Access Manager allows . This issue affects User Rights Access Manager: from n/a through 1.1.2.
Product
User Rights Access Manager
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Advanced Access Manager: Unauthenticated Arbitrary File ReadCVE-2019-25213 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
Product
Advanced Access Manager
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 28, 2024Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive informCVE-2024-4556 · Other software · OpenText · reported by security@opentext.comMedium 5.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive information. This issue affects NetIQ Access Manager before 5.0.4 and before 5.1.
Product
NetIQ Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microfocus.com microfocus.com
Aug 28, 2024Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario.CVE-2024-4555 · Other software · OpenText · reported by security@opentext.comHigh 7.7
Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1
Product
NetIQ Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microfocus.com microfocus.com
Aug 28, 2024Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack.CVE-2024-4554 · Other software · OpenText · reported by security@opentext.comHigh 7.3
Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5.0.4.1 and 5.1.
Product
Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microfocus.com microfocus.com
Aug 21, 2024SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash.CVE-2020-11847 · Other software · OpenText · reported by security@opentext.comHigh 8.2
SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.
Product
Privileged Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netiq.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.