Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
210 results · page 2 of 5
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47163 · Other software · duck-organization · reported by GitHubHigh 7.2
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2026MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malCVE-2018-25411 · Other software · M-Gb · reported by VulnCheckHigh 8.8
MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to extract sensitive database information including table and column names.
- Product
- MGB OpenSource Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm-gb.orgsourceforge.net
May 18, 2026A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2.CVE-2026-8803 · Other software · opensourcepos · reported by VulDBMedium 6.3
A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."
- Product
- Open Source Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2.CVE-2026-8802 · Other software · opensourcepos · reported by VulDBMedium 5.3
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.
- Product
- Open Source Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Open Source Social Network (OSSN) is open-source social networking software developed in PHP.CVE-2026-41309 · Other software · opensource-socialnetwork · reported by GitHubHigh 8.2
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \times 4000$ pixels) before processing begins.
- Product
- opensource-socialnetwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-40867 · Other software · horilla-opensource · reported by GitHubHigh 7.1
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-40866 · Other software · horilla-opensource · reported by GitHubHigh 8.6
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-40865 · Other software · horilla-opensource · reported by GitHubHigh 7.1
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.CVE-2026-32712 · Other software · opensourcepos · reported by GitHubMedium 5.4
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured with escape: false in the bootstrap-table column configuration, causing customer names to be rendered as raw HTML. An attacker with customer management permissions can inject arbitrary JavaScript into a customer's first_name or last_name field, which executes in the browser of any user viewing the Daily Sales page. This vulnerability is fixed in 3.4.3.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.CVE-2026-39380 · Other software · opensourcepos · reported by GitHubMedium 5.4
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2026-33730 · Other software · opensourcepos · reported by GitHubMedium 6.5
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32300 · Other software · opensource-workshop · reported by GitHubHigh 8.1
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32299 · Other software · opensource-workshop · reported by GitHubHigh 7.5
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32279 · Other software · opensource-workshop · reported by GitHubMedium 6.8
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32278 · Other software · opensource-workshop · reported by GitHubHigh 8.2
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32277 · Other software · opensource-workshop · reported by GitHubHigh 8.7
Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32276 · Other software · opensource-workshop · reported by GitHubHigh 8.8
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.CVE-2026-32888 · Other software · opensourcepos · reported by GitHubHigh 8.8
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute arbitrary SQL queries. A patch did not exist at the time of publication.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.CVE-2025-70042 · Other software · Opensourcelabs · reported by MITRECritical 9.8
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
- Product
- Thermakube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 23, 2026A flaw has been found in horilla-opensource horilla up to 1.0.2.CVE-2026-3050 · Other software · horilla-opensource · reported by VulDBLow 2
A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.0.3 is recommended to address this issue. Patch name: fc5c8e55988e89273012491b5f097b762b474546. It is suggested to upgrade the affected component.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was detected in horilla-opensource horilla up to 1.0.2.CVE-2026-3049 · Other software · horilla-opensource · reported by VulDBLow 2.1
A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.CVE-2026-26746 · Other software · Opensourcepos · reported by MITREHigh 8.8
OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field.CVE-2026-26745 · Other software · Opensourcepos · reported by MITREMedium 5.3
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN.CVE-2026-25998 · Other software · strongswan · reported by GitHubHigh 8.7
strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials.
- Product
- strongMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web sCVE-2025-70095 · Other software · Opensourcepos · reported by MITREMedium 6.5
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTCVE-2025-70094 · Other software · Opensourcepos · reported by MITREMedium 6.5
A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Category parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.CVE-2025-70093 · Other software · Opensourcepos · reported by MITREHigh 7.4
An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecCVE-2025-70091 · Other software · Opensourcepos · reported by MITREMedium 6.5
A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopensourcepos.org
Feb 12, 2026A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecCVE-2025-70092 · Other software · Opensourcepos · reported by MITREMedium 5.5
A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3.CVE-2026-2141 · Other software · WuKongOpenSource · reported by VulDBLow 2.1
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WukongCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource (third_party/faad2-2.7/libfaaCVE-2026-1465 · Other software · anyrtcIO-Community · reported by cve_disclosure@tech.gov.sgHigh 8.7
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource (third_party/faad2-2.7/libfaad modules). This vulnerability is associated with program files bits.C, syntax.C. This issue affects anyRTC-RTMP-OpenSource: before 1.0.
- Product
- anyRTC-RTMP-OpenSource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24039 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self-approve documents they have uploaded. The document-approval UI is intended to be restricted to administrator or high-privilege roles only; however, an insufficient server-side authorization check on the approval endpoint lets a standard employee modify the approval status of their own uploaded document. A successful exploitation allows users with only employee-level permissions to alter application state reserved for administrators. This undermines the integrity of HR processes (for example, acceptance of credentials, certifications, or supporting materials), and may enable submission of unvetted documents. This issue is fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24038 · Other software · horilla-opensource · reported by GitHubHigh 8.1
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24037 · Other software · horilla-opensource · reported by GitHubMedium 4.8
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24036 · Other software · horilla-opensource · reported by GitHubMedium 5.3
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24035 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24034 · Other software · horilla-opensource · reported by GitHubMedium 5.4
Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24010 · Other software · horilla-opensource · reported by GitHubHigh 8
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Outray openSource ngrok alternative.CVE-2026-22819 · Other software · akinloluwami · reported by GitHubMedium 5.9
Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.
- Product
- outray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Outray openSource ngrok alternative.CVE-2026-22820 · Other software · akinloluwami · reported by GitHubMedium 6.3
Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.
- Product
- outray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2025-68658 · Other software · opensourcepos · reported by GitHubMedium 4.3
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration (Information) functionality. An authenticated user with the permission “Configuration: Change OSPOS's Configuration” can inject a malicious JavaScript payload into the Company Name field when updating Information in Configuration. The malicious payload is stored and later triggered when a user accesses /sales/complete. First select Sales, and choose New Item to create an item, then click on Completed . Due to insufficient input validation and output encoding, the payload is rendered and executed in the user’s browser, resulting in a stored XSS vulnerability. This vulnerability is fixed in 3.4.2.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2025-68434 · Other software · opensourcepos · reported by GitHubHigh 8.8
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection lin
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2025-68147 · Other software · opensourcepos · reported by GitHubHigh 8.1
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts. An attacker with access to the "Store Configuration" (such as a rogue administrator or an account compromised via the separate CSRF vulnerability) can inject malicious JavaScript payloads into this field. These payloads are executed in the browser of any user (including other administrators and sales staff) whenever they view a receipt or complete a transaction. This can lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim. The vulnerability has been patched in version 3.4.2 by ensuring the output is escaped using the `esc()` function in the receipt template. As a temporary mitigation, administrators should ensure the "Return Policy" field contains only plain text and strictly avoid entering any HTML tags. There is no code-based worka
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web scriCVE-2025-66924 · Other software · Opensourcepos · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web scriCVE-2025-66923 · Other software · Opensourcepos · reported by MITREHigh 7.2
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web sCVE-2025-66921 · Other software · Opensourcepos · reported by MITREHigh 7.2
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validatCVE-2025-63800 · Other software · Opensourcepos · reported by MITREHigh 7.5
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.CVE-2025-63585 · Other software · Opensource-socialnetwork · reported by MITREMedium 6.5
OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.
- Product
- Open Source Social Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends.CVE-2025-63441 · Other software · Opensource-socialnetwork · reported by MITREHigh 7.3
Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends.
- Product
- Open Source Social Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Horilla is a free and open source Human Resource Management System (HRMS).CVE-2025-59832 · Other software · horilla-opensource · reported by GitHubCritical 9.9
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.