Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
94 results · page 2 of 2
Aug 27, 2025The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET.CVE-2025-30038 · Other software · CGM · reported by cvd@cert.plHigh 7.3
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessCVE-2025-30037 · Other software · CGM · reported by cvd@cert.plHigh 8.8
The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the application server on port 443/tcp.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code.CVE-2025-30036 · Other software · CGM · reported by cvd@cert.plHigh 8.8
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.CVE-2025-2313 · Other software · CGM · reported by cvd@cert.plCritical 9.4
In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTMLCVE-2025-50481 · Other software · Jupo · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface.CVE-2025-6050 · Other software · jupo · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 4.8
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
- Product
- mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netgithub.com
May 5, 2025Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.CVE-2025-29573 · Other software · Jupo · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsquadappsec.com
Oct 24, 2024iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability.CVE-2024-10313 · Other software · iniNet Solutions · reported by ics-cert@hq.dhs.govHigh 8.6
iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control.
- Product
- SpiderControl SCADA PC HMI Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.CVE-2024-8232 · Other software · iniNet Solutions GmbH · reported by ics-cert@hq.dhs.govHigh 8.7
SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.
- Product
- SpiderControl SCADA Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote CVE-2024-41628 · Other software · severalnines · reported by MITREHigh 7.5
Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.
- Product
- clustercontrol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.severalnines.comdocs.severalnines.com
Feb 28, 2024An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.CVE-2024-25170 · Other software · jupo · reported by MITRECritical 9.1
An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
- Product
- mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.CVE-2024-25169 · Other software · Jupo · reported by MITRECritical 9.8
An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal.CVE-2023-3329 · Other software · iniNet · reported by ics-cert@hq.dhs.govMedium 6.5
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
- Product
- SCADAWebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly.CVE-2021-3639 · Other software · Uninett · reported by Red HatMedium 6.1
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
- Product
- MOD Auth Mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 27, 2021Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpoCVE-2020-19002 · Other software · Jupo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2020The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the REACVE-2019-12366 · Other software · 9folders · reported by MITREMedium 6.1
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
- Product
- Nine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrelease-notes.9folders.comgubello.me
Mar 27, 2019A vulnerability was found in mod_auth_mellon before v0.14.2.CVE-2019-3877 · Other software · uninett · reported by Red HatMedium 5.8
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Product
- mod_auth_mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 26, 2019A vulnerability was found in mod_auth_mellon before v0.14.2.CVE-2019-3878 · Other software · uninett · reported by Red HatHigh 8.1
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
- Product
- mod_auth_mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 28, 2018Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.CVE-2018-16632 · Other software · Jupo · reported by MITREMedium 4.8
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.CVE-2017-17689 · Other software · 9folders · reported by MITREMedium 5.9
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
- Product
- Nine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comefail.de
May 8, 2018Severalnines ClusterControl before 1.6.0-4699 allows XSS.CVE-2018-10817 · Other software · Severalnines · reported by MITREMedium 6.1
Severalnines ClusterControl before 1.6.0-4699 allows XSS.
- Product
- Clustercontrol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.severalnines.comsupport.severalnines.com
Oct 4, 2017An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100.CVE-2017-13995 · Other software · Spidercontrol · reported by ics-cert@hq.dhs.govCritical 10
An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.
- Product
- Ininet Webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
May 12, 2017The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by CVE-2017-8925 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgdebian.org
Mar 13, 2017mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy theirCVE-2017-6807 · Other software · Uninett · reported by MITREMedium 6.1
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
- Product
- MOD Auth Mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 24, 2015IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain senCVE-2015-1005 · Other software · Ininet Solutions · reported by ics-cert@hq.dhs.govLow 2.1
IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
- Product
- Scada Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Oct 24, 2015Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathnamCVE-2015-1003 · Other software · Ininet Solutions · reported by ics-cert@hq.dhs.govMedium 5
Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname.
- Product
- Scada Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Oct 24, 2015IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.CVE-2015-1002 · Other software · Ininet Solutions · reported by ics-cert@hq.dhs.govMedium 6.4
IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
- Product
- Scada Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Oct 24, 2015Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long fieldCVE-2015-1001 · Other software · Ininet Solutions · reported by ics-cert@hq.dhs.govHigh 10
Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
- Product
- Scada Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Nov 15, 2014The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecifieCVE-2014-8566 · Other software · Uninett · reported by MITREMedium 6.4
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
- Product
- MOD Auth Mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinux.oracle.comrhn.redhat.com
Nov 14, 2014The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggeCVE-2014-8567 · Other software · Uninett · reported by MITREHigh 9.4
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Product
- MOD Auth Mellon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinux.oracle.comrhn.redhat.com
Oct 16, 2014The SudaniNet (aka com.sudaninet.wtwqiqbegq_btwlda) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midCVE-2014-6961 · Other software · Sudaninet · reported by cret@cert.orgMedium 5.4
The SudaniNet (aka com.sudaninet.wtwqiqbegq_btwlda) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Sudaninet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 8, 2014The 9GAG - Funny pics and videos (aka com.ninegag.android.app) application 2.4.10 for Android does not verify X.509 certificates from SSL servers, which allows CVE-2014-5669 · Other software · 9gag · reported by cret@cert.orgMedium 5.4
The 9GAG - Funny pics and videos (aka com.ninegag.android.app) application 2.4.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 9gag - Funny Pics And Videos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 19, 2012The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to thCVE-2012-4566 · Other software · Uninett · reported by Red HatMedium 6.4
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523.
- Product
- Radsecproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.nordu.netsecunia.com
Nov 19, 2012radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used fCVE-2012-4523 · Other software · Uninett · reported by Red HatMedium 6.4
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.
- Product
- Radsecproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2009Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in CVE-2009-0550 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.technet.comosvdb.org
Feb 13, 2007The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of aCVE-2007-0217 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 10
The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.idefense.comsecunia.com
Oct 5, 2006wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long CCVE-2006-5162 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.
- Product
- Internet Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityreason.com
Sep 14, 2006Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) sign.php, and (3) admiCVE-2006-4437 · Other software · Venture Nine · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) sign.php, and (3) admin/index.php.
- Product
- Tagger LE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Sep 14, 2006Cross-site scripting (XSS) vulnerability in tag.php in CloudNine Interactive CJ Tag Board 3.0 allows remote attackers to inject arbitrary web script or HTML viaCVE-2006-4797 · Other software · CJ Design · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in tag.php in CloudNine Interactive CJ Tag Board 3.0 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a url BBcode tag in the cjmsg parameter.
- Product
- CJ TAG Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevuln.comsecurityreason.com
Aug 23, 2006SQL injection vulnerability in admin.php in CloudNine Interactive Links Manager 2006-06-12, when magic_quotes_gpc is disabled, allows remote attackers to executCVE-2006-4328 · Other software · Cloudnine Interactive · reported by MITREMedium 5.1
SQL injection vulnerability in admin.php in CloudNine Interactive Links Manager 2006-06-12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
- Product
- Links Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2006Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary CVE-2006-4327 · Other software · Cloudnine Interactive · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, or (3) keywords parameters.
- Product
- Links Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2003Format string vulnerability in LinuxNode (node) before 0.3.2 may allow attackers to cause a denial of service or execute arbitrary code.CVE-2003-0708 · Other software · Tomi Manninen · reported by MITREHigh 7.5
Format string vulnerability in LinuxNode (node) before 0.3.2 may allow attackers to cause a denial of service or execute arbitrary code.
- Product
- Linuxnode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2003Buffer overflow in LinuxNode (node) before 0.3.2 allows remote attackers to execute arbitrary code.CVE-2003-0707 · Other software · Tomi Manninen · reported by MITREHigh 7.5
Buffer overflow in LinuxNode (node) before 0.3.2 allows remote attackers to execute arbitrary code.
- Product
- Linuxnode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2002Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or CVE-2002-2330 · Other software · Uninet · reported by MITREMedium 5
Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers.
- Product
- Statsplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.