Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
340 results · page 2 of 7
Dec 21, 2022Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to CVE-2022-3189 · Other software · Dataprobe · reported by ics-cert@hq.dhs.govMedium 5.3
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter.
- Product
- iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.CVE-2022-38254 · Other software · Nagios · reported by MITREMedium 6.1
Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical.CVE-2017-20128 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- KB Messages PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comexploit-db.com
Jun 2, 2022phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth_user" parameter in index.php script.CVE-2022-30352 · Websites & servers · Phpabook Project · reported by MITRECritical 9.8
phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth_user" parameter in index.php script.
- Product
- Phpabook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurity-help.czexploit-db.com
Aug 18, 2021Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script.CVE-2021-38710 · Other software · Yclas · reported by MITREMedium 6.1
Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE_NAME parameter.
- Product
- Yclas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).CVE-2021-21805 · Other software · Advantech · reported by talos-cna@cisco.comCritical 9.8
An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).CVE-2021-21804 · Other software · Advantech · reported by talos-cna@cisco.comCritical 9.8
A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.CVE-2021-21803 · Other software · Advantech · reported by talos-cna@cisco.comMedium 6.1
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.CVE-2021-21802 · Other software · Advantech · reported by talos-cna@cisco.comMedium 6.1
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.CVE-2021-21801 · Other software · Advantech · reported by talos-cna@cisco.comMedium 6.1
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).CVE-2021-21800 · Other software · Advantech · reported by talos-cna@cisco.comMedium 6.1
Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 16, 2021Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).CVE-2021-21799 · Other software · Advantech · reported by talos-cna@cisco.comMedium 6.1
Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- R-seenet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 30, 2021CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.CVE-2021-28935 · Other software · Cmsmadesimple · reported by MITREMedium 5.4
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.cmsmadesimple.orgpacketstormsecurity.com
Mar 25, 2021A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to read arbitrary serveCVE-2020-10584 · Other software · Invigo · reported by MITREHigh 7.5
A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application.
- Product
- Automatic Device Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on tCVE-2020-10583 · Other software · Invigo · reported by MITREHigh 8.8
The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application.
- Product
- Automatic Device Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to execute arbitrary SQLCVE-2020-10582 · Other software · Invigo · reported by MITRECritical 9.8
A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to execute arbitrary SQL requests (including data reading and modification) on the database.
- Product
- Automatic Device Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute CVE-2020-10580 · Other software · Invigo · reported by MITREHigh 8.8
A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary PHP code on the server as the user running the application.
- Product
- Automatic Device Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to list the content of arbCVE-2020-10579 · Other software · Invigo · reported by MITREHigh 7.5
A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to list the content of arbitrary server directories accessible to the user running the application.
- Product
- Automatic Device Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP inCVE-2021-20187 · Other software · Moodle · reported by Red HatHigh 7.2
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.CVE-2020-19364 · Other software · Open-emr · reported by MITREHigh 8.8
OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.CVE-2017-18923 · Other software · Beronet · reported by MITREHigh 7.5
beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
- Product
- Voice Over Internet Protocol Gateways Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordberonet.atlassian.netheise.de
Jul 28, 2020rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script.CVE-2020-15715 · Other software · Rconfig · reported by MITRECritical 9.9
rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comrconfig.com
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script.CVE-2020-15718 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script.CVE-2020-15717 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgitlab.com
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script.CVE-2020-15716 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Mar 16, 2020index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execCVE-2020-5844 · Other software · Artica · reported by MITREHigh 7.2
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 13, 2020A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which coulCVE-2014-4170 · Other software · Freereprintables · reported by MITRECritical 9.8
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information.
- Product
- Articlefr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Feb 3, 2020Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URCVE-2013-2621 · Other software · Telaen Project · reported by MITREMedium 6.1
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
- Product
- Telaen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 31, 2020controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.CVE-2020-8440 · Other software · Simplejobscript · reported by MITRECritical 9.8
controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.
- Product
- Simplejobscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.CVE-2013-0739 · Other software · Chamilo · reported by PSIRT-CNA@flexerasoftware.comMedium 6.1
Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 10, 2020Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.CVE-2012-4030 · Other software · Chamilo · reported by MITREHigh 7.5
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.CVE-2019-20337 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 7.2
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.CVE-2019-20336 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.1
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2019ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review requestCVE-2013-4796 · Other software · Reviewboard · reported by MITREHigh 8.8
ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request
- Product
- Reviewboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtripwire.comexchange.xforce.ibmcloud.com
Nov 20, 2019MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.CVE-2013-1817 · Other software · mediawiki · reported by Red HatHigh 7.5
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
- Product
- mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgopenwall.com
Jul 15, 2019phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS).CVE-2019-1010028 · Websites & servers · PHP Scripts Mall Pvt. Ltd. · reported by josh@bress.netMedium 6.1
phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />.
- Product
- School College Portal with ERP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitehatck01.blogspot.comwhitehatck01.blogspot.com
Jun 20, 2019SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.CVE-2019-12744 · Other software · Seeddms · reported by MITREHigh 7.5
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 6, 2019An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7.CVE-2019-7554 · Other software · API Based Travel Booking Project · reported by MITREMedium 6.1
An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter.
- Product
- API Based Travel Booking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityhitlist.blogspot.comphpscriptsmall.com
Jun 6, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.CVE-2019-7553 · Other software · Chartered Accountant \ · reported by MITREMedium 5.4
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityhitlist.blogspot.comsecurityhitlist.blogspot.com
Jun 6, 2019An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2.CVE-2019-7552 · Other software · Investment MLM Software Project · reported by MITREMedium 5.4
An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section.
- Product
- Investment MLM Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityhitlist.blogspot.comphpscriptsmall.com
May 13, 2019pageflipbook.php script from index.php in Page Flip Book plugin for: Directory traversalCVE-2012-6652 · WordPress plugins & themes · reported by MITRECritical 9.8
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
- Product
- pageflipbook.php script from index.php in Page Flip Book plugin for
- What to do
- Update pageflipbook.php script from index.php in Page Flip Book plugin for to the newest version.
Full record and what to do →NVD recordceriksen.comwordpress.org
Mar 29, 2019PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.CVE-2019-9605 · Other software · Online Lottery PHP Readymade Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.
- Product
- Online Lottery PHP Readymade Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Mar 29, 2019PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions.CVE-2019-9604 · Other software · Online Lottery PHP Readymade Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions.
- Product
- Online Lottery PHP Readymade Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Mar 28, 2019PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount.CVE-2019-9864 · Other software · Amazon Affiliate Store Project · reported by MITREMedium 6.5
PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount.
- Product
- Amazon Affiliate Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Mar 21, 2019PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.CVE-2019-7437 · Other software · Opensource Classified ADS Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.
- Product
- Opensource Classified ADS Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.CVE-2019-7436 · Other software · Opensource Classified ADS Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.
- Product
- Opensource Classified ADS Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form.CVE-2019-7435 · Other software · Opensource Classified ADS Script Project · reported by MITREMedium 5.3
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form.
- Product
- Opensource Classified ADS Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory.CVE-2019-7434 · Other software · Rental Bike Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory.
- Product
- Rental Bike Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.CVE-2019-7433 · Other software · Rental Bike Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
- Product
- Rental Bike Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.CVE-2019-7432 · Other software · Rental Bike Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.
- Product
- Rental Bike Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.