Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
77 results · page 2 of 2
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.phpCVE-2024-8464 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Local File Inclusion, Arbitrary Settings Update, and User CreationCVE-2024-7950 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 18, 2024WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2024-43266 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
- Product
- WP Job Portal
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35760 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows DOM-Based XSS.This issue affects WP Job Portal: from n/a through <= 2.1.3.
- Product
- WP Job Portal
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35759 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.3.
- Product
- WP Job Portal
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2024WP Job Portal – A Complete Job Board: Missing AuthorizationCVE-2022-41786 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
- Product
- WP Job Portal – A Complete Job Board
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 6, 2024A vulnerability was found in Online Job Portal 1.0 and classified as problematic.CVE-2024-0262 · Other software · Projectworlds · reported by VulDBLow 2.4
A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title><scRipt>alert(0x00C57D)</scRipt> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024WP Job Portal – A Complete Job Board: Cross-Site Request Forgery (CSRF)CVE-2023-52184 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.
- Product
- WP Job Portal – A Complete Job Board
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-49689 · Other software · Kashipara Group · reported by help@fluidattacks.comCritical 9.8
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comkashipara.com
Dec 21, 2023Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-49688 · Other software · Kashipara Group · reported by help@fluidattacks.comCritical 9.8
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comkashipara.com
Dec 21, 2023Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-49681 · Other software · Kashipara Group · reported by help@fluidattacks.comCritical 9.8
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comkashipara.com
Dec 21, 2023Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-49677 · Other software · Kashipara Group · reported by help@fluidattacks.comCritical 9.8
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comkashipara.com
Nov 7, 2023Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46679 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Nov 7, 2023Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-46677 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 25, 2023WP Job Portal: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-4490 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
- Product
- WP Job Portal
- Fixed in
- 2.0.6
- What to do
- Update WP Job Portal to 2.0.6 or newer.
Sep 22, 2023SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.CVE-2023-43469 · Other software · Online JOB Portal Project · reported by MITRECritical 9.8
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2023SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.CVE-2023-43468 · Other software · Online JOB Portal Project · reported by MITRECritical 9.8
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.
- Product
- Online JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 16, 2022A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13.CVE-2017-20133 · Other software · Itech · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotely.
- Product
- Job Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directCVE-2018-20643 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript coCVE-2018-20642 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript code in the KeySkills field.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.CVE-2018-20641 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.CVE-2018-20640 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar.CVE-2018-20639 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2018PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.CVE-2018-14082 · Other software · Freelancewebdesignerchennai · reported by MITREMedium 5.4
PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.
- Product
- JOB Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgkaim.comexploit-db.com
Feb 28, 2018PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - ICVE-2018-7469 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - Industry Type).
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordneetech18.blogspot.inneetech18.blogspot.in
Dec 13, 2017Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.CVE-2017-17596 · Other software · Entrepreneur JOB Portal Script Project · reported by MITRECritical 9.8
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 1, 2008SQL injection vulnerability in job_seeker/applynow.php in AvailScript Job Portal Script allows remote attackers to execute arbitrary SQL commands via the jid paCVE-2008-4373 · Other software · Availscript · reported by MITREHigh 7.5
SQL injection vulnerability in job_seeker/applynow.php in AvailScript Job Portal Script allows remote attackers to execute arbitrary SQL commands via the jid parameter.
- Product
- Availscript Jobs Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.