Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
215 results · page 2 of 5
Oct 14, 2025OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileCVE-2025-10243 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.2
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- Endpoint Manager Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileCVE-2025-10242 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.2
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- Endpoint Manager Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file conCVE-2025-60880 · Other software · Webkul · reported by MITREHigh 8.3
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
- Product
- Bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 8, 2025An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" CVE-2025-57457 · Other software · reported by MITREHigh 8.8
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticateCVE-2025-10223 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Medium 5.3
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
- Product
- AxxonOne C-Werk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uplCVE-2025-52921 · Other software · InnoShop · reported by MITRECritical 9.9
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.CVE-2025-48926 · Other software · TeleMessage · reported by MITREMedium 4.3
The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.
- Product
- service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.CVE-2025-28232 · Other software · Jmbroadcast · reported by MITRECritical 9.1
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
- Product
- Jmb0150 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2024-55604 · Other software · appsmithorg · reported by GitHubMedium 4.8
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payloadCVE-2024-9699 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.CVE-2024-48461 · Other software · telsalogger · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.
- Product
- admin_panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commohammedshine.github.io
Aug 27, 2024A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, lCVE-2024-45264 · Other software · skysystem · reported by MITREHigh 8.8
A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges.
- Product
- arfa_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-bCVE-2024-28089 · Other software · hitrontech · reported by MITREMedium 5.2
Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.html#advanced_location (aka the Device Location page). This can cause a denial of service or lead to information disclosure.
- Product
- coda-4582u_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1.CVE-2024-2211 · Other software · Gophish · reported by cve-coordination@incibe.esMedium 4.6
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.
- Product
- Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.CVE-2024-25169 · Other software · Jupo · reported by MITRECritical 9.8
An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25226 · Other software · Code-projects · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25225 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectCVE-2024-25224 · Other software · Code-projects · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php.CVE-2024-25223 · Other software · Code-projects · reported by MITRECritical 9.8
Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php.
- Product
- Simple Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls.CVE-2023-32333 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls. IBM X-Force ID: 255073.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 16, 2024Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2024-22411 · Other software · avo-hq · reported by GitHubMedium 6.5
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2024-22191 · Other software · avo-hq · reported by GitHubHigh 7.3
Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection.CVE-2023-4541 · Other software · Ween Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 13, 2023Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.CVE-2023-31754 · Other software · Optimizely · reported by MITREMedium 4.8
Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.
- Product
- Optimizely CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.withsecure.comlabs.withsecure.com
Oct 26, 2023The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.CVE-2023-46754 · Other software · Obl.ong · reported by MITREMedium 5.3
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.
- Product
- Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML vCVE-2023-27148 · Other software · Enhancesoft · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Oct 5, 2023Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.CVE-2023-43260 · Other software · milesight · reported by MITREMedium 6.1
Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.
- Product
- ur32l_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 3, 2023This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.CVE-2023-4564 · Other software · Capensis · reported by cve-coordination@incibe.esMedium 4.7
This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.
- Product
- Canopsis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.canopsis.netgit.canopsis.net
Sep 27, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection.CVE-2023-4737 · Other software · Hedef Tracking · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.
- Product
- Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 5, 2023 Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows CVE-2023-4480 · Websites & servers · PHPFusion · reported by disclosure@synopsys.comMedium 5.5
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.
- Product
- PHPFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
- Product
- Booking Manager
- Fixed in
- 2.0.29
- What to do
- Update Booking Manager to 2.0.29 or newer.
Aug 4, 2023ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.CVE-2023-39112 · Other software · Shopex · reported by MITREMedium 6.5
ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.CVE-2023-36211 · Other software · Cubiclesoft · reported by MITREMedium 5.4
The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.
- Product
- Barebones CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 5, 2023A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary webCVE-2023-27225 · Other software · User Registration & Login And User Management System With Admin Panel Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field.
- Product
- User Registration & Login And User Management System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.compacketstormsecurity.com
Jul 4, 2023Protect WP Admin: Discloses the URL of the admin panel via a redirection of a crafted URLCVE-2023-3139 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.
- Product
- Protect WP Admin
- Fixed in
- 4.0
- What to do
- Update Protect WP Admin to 4.0 or newer.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jun 28, 2023A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute aCVE-2023-34648 · Other software · User Registration & Login And User Management System With Admin Panel Project · reported by MITREMedium 6.1
A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.
- Product
- User Registration & Login And User Management System With Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Avo is an open source ruby on rails admin panel creation framework.CVE-2023-34103 · Other software · avo-hq · reported by GitHubHigh 7.3
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Avo is an open source ruby on rails admin panel creation framework.CVE-2023-34102 · Other software · avo-hq · reported by GitHubHigh 8.3
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
- Product
- Cloud Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 6, 2023Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2023-29010 · Other software · Budibase · reported by GitHubMedium 6.5
Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin paCVE-2023-26511 · Other software · Propius · reported by MITRECritical 9.8
A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system.
- Product
- Machineselector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.CVE-2023-24364 · Other software · Oretnom23 · reported by MITREHigh 8.8
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.
- Product
- Simple Customer Relationship Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Dec 1, 2022In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.CVE-2022-44212 · Other software · Gl-inet · reported by MITREMedium 5.9
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
- Product
- Goodcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.gl-inet.comforum.gl-inet.com
Nov 30, 2022Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.CVE-2022-44097 · Other software · Book Store Management System Project · reported by MITRECritical 9.8
Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
- Product
- Book Store Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2022Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.CVE-2022-44096 · Other software · Sanitization Management System Project · reported by MITRECritical 9.8
Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2022In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.CVE-2022-42176 · Other software · Pctechsoft · reported by MITREHigh 7.8
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.
- Product
- Pcsecure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.CVE-2022-38251 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.CVE-2022-38247 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel.CVE-2022-36203 · Other software · Doctor's Appointment System Project · reported by MITREMedium 6.1
Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the administrator account by stealing the cookie via XSS.
- Product
- Doctor's Appointment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.