Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
218 results · page 2 of 5
Oct 16, 2024ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to CVE-2024-48180 · Other software · classcms · reported by MITRECritical 9.8
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2024A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8.CVE-2024-8145 · Other software · classcms · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the argument Title leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2024A vulnerability classified as problematic was found in ClassCMS 4.8.CVE-2024-8144 · Other software · classcms · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024A vulnerability was found in ClassCMS 4.5.CVE-2024-6932 · Other software · classcms · reported by VulDBMedium 5.3
A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?action=home&do=shop:index&keyword=&kind=all. The manipulation of the argument order leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271987.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."CVE-2024-31613 · Other software · bosscms · reported by MITREMedium 5.4
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
- Product
- bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuratioCVE-2024-31609 · Other software · code-projects · reported by MITREHigh 7.1
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
- Product
- simple_school_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injectedCVE-2024-30952 · Other software · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix wasCVE-2024-31011 · Other software · beescms · reported by MITRECritical 9.8
Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin_template.php.
- Product
- beescms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=indCVE-2024-22569 · Other software · Poscms · reported by MITREMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0.
- Product
- Poscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.cCVE-2024-22938 · Other software · Bosscms · reported by MITREHigh 7.8
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1.CVE-2024-0414 · Other software · DeShang · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.
- Product
- DSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Oct 28, 2023A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3.CVE-2023-5837 · Other software · AlexanderLivanov · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3. This vulnerability affects unknown code of the file profile.php of the component Cookie Handler. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243802 is the identifier assigned to this vulnerability.
- Product
- FotosCMS2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.CVE-2023-43953 · Other software · Sscms · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.CVE-2023-43952 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.CVE-2023-43951 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2023-37785 · Other software · Impresscms · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.CVE-2020-21474 · Other software · Nucleuscms · reported by MITRECritical 9.8
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.
- Product
- Nucleuscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.phpCVE-2020-22334 · Other software · Beescms · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.php.
- Product
- Beescms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023SiteServerCMS 7.1.3 sscms has a file read vulnerability.CVE-2022-44299 · Other software · Sscms · reported by MITREMedium 4.9
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023SiteServer CMS 7.1.3 is vulnerable to SQL Injection.CVE-2022-44298 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.CVE-2022-44297 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.CVE-2022-45966 · Other software · Classcms Project · reported by MITRECritical 9.8
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to injecCVE-2021-43657 · Other software · Simple Client Management System Project · reported by MITREMedium 5.4
A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields.
- Product
- Simple Client Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-44937 · Other software · Bosscms · reported by MITREMedium 6.5
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools.CVE-2022-39297 · Other software · melisplatform · reported by GitHubHigh 7.7
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Product
- melis-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31679 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31678 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31677 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022A reflected XSS was discovered in PESCMS-V2.3.3.CVE-2021-31676 · Other software · Pescms · reported by MITREMedium 6.1
A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Nucleus CMS v3.71 is affected by a file upload vulnerability.CVE-2021-37770 · Other software · Nucleuscms · reported by MITREHigh 7.2
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.
- Product
- Nucleus CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.CVE-2022-31908 · Other software · Student Registration And FEE Payment System Project · reported by MITREHigh 7.2
Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
- Product
- Student Registration And FEE Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.CVE-2022-30898 · Other software · Chshcms · reported by MITREMedium 6.5
A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).CVE-2022-30349 · Other software · Sscms · reported by MITREMedium 6.1
siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.CVE-2022-29689 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.CVE-2022-29688 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.CVE-2022-29687 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.CVE-2022-29686 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.CVE-2022-29685 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.CVE-2022-29684 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.CVE-2022-29683 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.CVE-2022-29682 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.CVE-2022-29681 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.CVE-2022-29680 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.CVE-2022-29676 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.CVE-2022-29670 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.CVE-2022-29669 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy.CVE-2022-29667 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.CVE-2022-29666 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.CVE-2022-29665 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.CVE-2022-29664 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.