Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
269 results · page 2 of 6
Jul 14, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-49459 · Other software · cure53 · reported by GitHubMedium 6.1
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-49458 · Other software · cure53 · reported by GitHubMedium 6.1
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-47423 · Other software · cure53 · reported by GitHubHigh 8.2
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same geneCVE-2026-61500 · Other software · rejetto · reported by VulnCheckCritical 9.3
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
- Product
- hfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 15, 2026Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.CVE-2026-34892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
- Affected
- up to 1.0.271
- What to do
- Affects up to 1.0.271. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized accessCVE-2025-12714 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.
- Product
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- Affected
- up to 1.0.271
- What to do
- Affects up to 1.0.271. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2026Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.CVE-2026-44719 · Other software · mathesar-foundation · reported by GitHubMedium 5.3
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a database_id without verifying that the requesting user was a collaborator on that database. An authenticated user on the same Mathesar installation could use these methods to view Mathesar-managed metadata for databases where they were not a collaborator. Depending on the database and features in use, exposed metadata could include collaborator mappings, table metadata, saved exploration metadata, and form metadata. For forms, the exposed metadata included form tokens. For public forms, possession of the token is equivalent to possession of the public form link, which allows submission to the form under the form’s configured PostgreSQL role. This vulnerability is fixed in 0.10.0.
- Product
- mathesar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.CVE-2026-44718 · Other software · mathesar-foundation · reported by GitHubMedium 5.3
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration_id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.
- Product
- mathesar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library.CVE-2026-44717 · Other software · 611711Dark · reported by GitHubCritical 9.8
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.
- Product
- mcp_calculate_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026math-codegen generates code from mathematical expressions.CVE-2026-41507 · Other software · mauriciopoppe · reported by GitHubCritical 9.8
math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.
- Product
- math-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Math.js is an extensive math library for JavaScript and Node.js.CVE-2026-41139 · Other software · josdejong · reported by GitHubHigh 8.8
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
- Product
- mathjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Math.js is an extensive math library for JavaScript and Node.js.CVE-2026-40897 · Other software · josdejong · reported by GitHubHigh 8.8
Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.
- Product
- mathjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-41240 · Other software · cure53 · reported by GitHubMedium 6
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-41239 · Other software · cure53 · reported by GitHubMedium 6.8
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.CVE-2026-41238 · Other software · cure53 · reported by GitHubMedium 6.9
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+.CVE-2026-40301 · Other software · rhukster · reported by GitHubMedium 4.7
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.
- Product
- dom-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026WM JqMath: Stored Cross-Site ScriptingCVE-2026-3998 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WM JqMath
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WM JqMath to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026Rank Math SEO PRO: Missing AuthorizationCVE-2026-28080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO PRO: from n/a through 3.0.95.
- Product
- Rank Math SEO PRO
- Affected
- up to 3.0.95
- What to do
- Affects up to 3.0.95. Update Rank Math SEO PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2026A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-2058 · Other software · mathurvishal · reported by VulDBMedium 5.5
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /postquerypublic.php of the component Post Query Details Page. This manipulation of the argument gnamex causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts.CVE-2026-24783 · Other software · script3 · reported by GitHubHigh 7.5
soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.
- Product
- soroban-fixed-point-math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint.CVE-2025-52410 · Other software · Vishalmathur · reported by MITRECritical 9.8
Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is not adequately sanitized before being used in SQL queries.
- Product
- Institute-of-current-students
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service.CVE-2025-31948 · Other software · reported by secure@intel.comMedium 4.8
Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2025The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables.CVE-2025-12735 · Other software · silentmatt · reported by cret@cert.orgCritical 9.8
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
- Product
- expr-eval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Rank Math SEO: Insertion of Sensitive Information Into Sent DataCVE-2025-64351 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.
- Product
- Rank Math SEO
- Affected
- up to 1.0.252.1
- What to do
- Affects up to 1.0.252.1. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Rank Math SEO: Missing AuthorizationCVE-2025-64350 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.
- Product
- Rank Math SEO
- Affected
- up to 1.0.252.1
- What to do
- Affects up to 1.0.252.1. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2025An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbiCVE-2025-50736 · Other software · reported by MITREMedium 6.1
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG fileCVE-2025-61514 · Other software · reported by MITREMedium 6.5
An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0.CVE-2025-55444 · Other software · Vishalmathur · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.
- Product
- Online Artwork And Fine Arts Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 31, 2025CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint.CVE-2025-50866 · Other software · Vishalmathur · reported by MITREMedium 6.1
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading to session hijacking or phishing attacks.
- Product
- Cloudclassroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embeddedCVE-2025-50867 · Other software · Vishalmathur · reported by MITREMedium 6.5
A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization.
- Product
- Cloudclassroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.CVE-2025-44608 · Other software · Vishalmathur · reported by MITREMedium 6.5
CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint.CVE-2025-51411 · Other software · Vishalmathur · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser by tricking them into visiting a crafted URL or submitting a malicious form. Successful exploitation may lead to session hijacking, credential theft, or other client-side attacks.
- Product
- Institute-of-current-students
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.CVE-2025-45143 · Other software · Devrafalko · reported by MITREHigh 7
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
- Product
- String-math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 20, 2025A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0.CVE-2025-46179 · Other software · Vishalmathur · reported by MITRECritical 9.8
A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, which is passed directly into backend SQL queries.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comportswigger.net
Jun 18, 2025CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability.CVE-2025-26199 · Other software · Vishalmathur · reported by MITRECritical 9.8
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 18, 2025CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component.CVE-2025-26198 · Other software · Vishalmathur · reported by MITRECritical 9.8
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 9, 2025Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project.CVE-2025-46178 · Other software · Vishalmathur · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0.CVE-2025-45542 · Other software · Vishalmathur · reported by MITREHigh 7.3
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0.CVE-2024-57459 · Other software · Vishalmathur · reported by MITREHigh 7.3
A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate user input, allowing an attacker to inject arbitrary SQL commands.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comowasp.org
May 30, 2025PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats.CVE-2025-48882 · Websites & servers · PHPOffice · reported by GitHubHigh 8.7
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
- Product
- Math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLiCVE-2025-29049 · Other software · reported by MITREMedium 6.3
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations.CVE-2024-8953 · Other software · composiohq · reported by security@huntr.devCritical 9.8
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
- Product
- composiohq/composio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Block Spam By Math Reloaded: Missing AuthorizationCVE-2025-28872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
- Product
- Block Spam By Math Reloaded
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Block Spam By Math Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28871 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
- Product
- Block Spam By Math Reloaded
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessmCVE-2024-57423 · Other software · Vishalmathur · reported by MITREMedium 6.1
A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessment function.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized loss of dataCVE-2024-13229 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the update_metadata() function in all versions up to, and including, 1.0.235. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete any schema metadata assigned to any post.
- Product
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- Affected
- up to 1.0.235
- What to do
- Affects up to 1.0.235. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Stored Cross-Site ScriptingCVE-2024-13227 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Rank Math API in all versions up to, and including, 1.0.235 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- Affected
- up to 1.0.235
- What to do
- Affects up to 1.0.235. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.CVE-2024-55194 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web.CVE-2025-23207 · Other software · KaTeX · reported by GitHubMedium 6.3
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.
- Product
- KaTeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2024WP MathJax: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP MathJax wp-mathjax-plus allows Stored XSS.This issue affects WP MathJax: from n/a through <= 1.0.1.
- Product
- WP MathJax
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP MathJax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.