Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 2 of 2
Jul 12, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-39914 · Other software · FOGProject · reported by GitHubCritical 9.8
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325.CVE-2024-3151 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Multi-Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 27, 2024A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320.CVE-2024-2998 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Store Update Page. The manipulation of the argument Store Name/Store Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258200. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Multi-Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 27, 2024A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320.CVE-2024-2997 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument Category Name/Model Name/Brand Name/Unit Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258199. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Multi-Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 27, 2024A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320.CVE-2024-2996 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been classified as problematic. Affected is an unknown function of the component Page Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258198 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Multi-Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 19, 2024A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311.CVE-2024-2639 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wholesale Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 29, 2024Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via theCVE-2023-51813 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via the staff_list parameter in the index.php component.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability was found in CodeAstro POS and Inventory Management System 1.0.CVE-2024-0422 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /new_item of the component New Item Creation Page. The manipulation of the argument new_item leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250441 was assigned to this vulnerability.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 13, 2023A vulnerability was found in CodeAstro POS and Inventory Management System 1.0.CVE-2023-6775 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /item/item_con. The manipulation of the argument item_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247911.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 13, 2023A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic.CVE-2023-6774 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /accounts_con/register_account. The manipulation of the argument Username with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247910 is the identifier assigned to this vulnerability.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 13, 2023A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic.CVE-2023-6773 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /accounts_con/register_account of the component User Creation Handler. The manipulation of the argument account_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247909 was assigned to this vulnerability.
- Product
- POS and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46237 · Other software · FOGProject · reported by GitHubMedium 5.8
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46236 · Other software · FOGProject · reported by GitHubHigh 8.6
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46235 · Other software · FOGProject · reported by GitHubMedium 5.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts oCVE-2023-39712 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Put section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Sep 7, 2023Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts oCVE-2023-39711 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Subtotal and Paidbill parameters under the Add New Put section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Sep 1, 2023Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts oCVE-2023-39714 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Sep 1, 2023Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts oCVE-2023-39710 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Aug 28, 2023Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts oCVE-2023-39709 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Aug 28, 2023A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or CVE-2023-39708 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Aug 25, 2023A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or CVE-2023-39707 · Other software · Free And Open Source Inventory Management System Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.
- Product
- Free And Open Source Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsourcecodester.com
Feb 27, 2023Part-DB is an open source inventory management system for your electronic components.CVE-2023-26042 · Other software · Part-DB · reported by GitHubMedium 6.1
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers CVE-2023-24234 · Other software · Inventory Management System Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Brand Name parameter.
- Product
- Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows atCVE-2023-24233 · Other software · Inventory Management System Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter.
- Product
- Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackeCVE-2023-24232 · Other software · Inventory Management System Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
- Product
- Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attaCVE-2023-24231 · Other software · Inventory Management System Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Categories Name parameter.
- Product
- Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2022Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.CVE-2022-44151 · Other software · Sanitization Management System Project · reported by MITRECritical 9.8
Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 20, 2022Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.CVE-2022-28993 · Other software · Bdtask · reported by MITRECritical 9.8
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.
- Product
- Multi Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 20, 2022Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.CVE-2022-28991 · Other software · Bdtask · reported by MITREHigh 7.5
Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.
- Product
- Multi Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 27, 2021Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.CVE-2020-36012 · Other software · Bdtask · reported by MITREMedium 4.8
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
- Product
- Multi-store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkislay00.medium.comkislay00.medium.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.