Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
108 results · page 2 of 3
Aug 20, 2025WP Discord Post Plus – Supports Unlimited Channels: Cross-Site Request Forgery (CSRF)CVE-2025-49896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.
- Product
- WP Discord Post Plus – Supports Unlimited Channels
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Discord Post Plus – Supports Unlimited Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 24, 2025Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own.CVE-2025-53940 · Other software · TryQuiet · reported by GitHubHigh 8.5
Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.
- Product
- quiet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025VoidBot Open-Source is a customizable Discord bot.CVE-2025-53943 · Other software · Death1Clown · reported by GitHubHigh 8.7
VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permission checks are not properly enforced for certain administrative commands. This allows users without the required roles or privileges to execute sensitive commands such as `ban`, `kick`, or `shutdown`, potentially disrupting server operations. Version 1.0.0 fixes the issue.
- Product
- VoidBot_open-source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscordjs.guidegithub.com
Jul 10, 2025DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel.CVE-2025-53371 · Other software · miraheze · reported by GitHubCritical 9.1
DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This allows for DOS by causing the server to read large files. SSRF is also possible if there are internal unprotected APIs that can be accessed using HTTP POST requests, which could also possibly lead to RCE. This vulnerability is fixed in commit 1f20d850cbcce5b15951c7c6127b87b927a5415e.
- Product
- DiscordNotifications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025miniOrange Discord Integration: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47672 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Discord Integration: from n/a through <= 2.2.2.
- Product
- miniOrange Discord Integration
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update miniOrange Discord Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2025A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows.CVE-2025-4525 · Other software · Discord · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Discord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 7, 2025WP Discord Invite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47638 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.
- Product
- WP Discord Invite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Discord Invite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MemberPress Discord Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.1.
- Product
- MemberPress Discord Addon
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update MemberPress Discord Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2025WP Discord Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.
- Product
- WP Discord Post
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Discord Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
- Product
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
- Affected
- up to 200.3.9
- What to do
- Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordminiorange.comwordfence.com
Feb 18, 2025Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution.CVE-2025-26604 · Other software · Discord-Agora · reported by GitHubHigh 8.3
Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the nature of arbitrary user-submited code execution, this allows user to execute potentially malicious code to perform damage or extract sensitive information. By loading the module containing the following code and run the command, the bot token can be extracted. Then the attacker can load a blocking module to sabotage the bot (DDoS attack) and the token can be used to make the fake bot act as the real one. If the bot has very high privilege, the attacker basically has full control before the user kicks the bot. Any Discord user that hosts Discord-Bot-Framework-Kernel before commit f0d9e70841a0e3170b88c4f8d562018ccd8e8b14 is affected. Users are advised to upgrade. Users unable to upgrade may attempt to limit their discord bot's access via configuration options.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows.CVE-2025-0732 · Other software · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-24375 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2024SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7.CVE-2024-45307 · Other software · onesoft-sudo · reported by GitHubHigh 8.8
SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretically able to update any configuration of the bot and potentially gain control over the bot's settings. Every version of v9 before v9.26.7 is affected. Other versions (e.g. v8) are not affected. Users should upgrade to version 9.26.7 to receive a patch. A workaround would be to create a command permission overwrite in the Database. A SQL statement provided in the GitHub Security Advisor can be executed to create a overwrite that disallows users without `ManageGuild` permission to run the `-config` command. Run the SQL statement for every server the bot is in, and replace `<guild_id>` with the appropriate Guild ID each time.
- Product
- sudobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024MEGABOT is a fully customized Discord bot for learning and fun.CVE-2024-43404 · Other software · NicPWNs · reported by GitHubCritical 9.8
MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.
- Product
- MEGABOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2024Red is a fully modular Discord bot.CVE-2024-39905 · Other software · Cog-Creators · reported by GitHubMedium 5.3
Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.
- Product
- Red-DiscordBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toString to several diffeCVE-2024-21521 · Other software · discordjs_opus · reported by report@snyk.ioHigh 7.5
All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a system crash.
- Product
- discordjs_opus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 27, 2024MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and storCVE-2024-35237 · Other software · ZelnickB · reported by GitHubHigh 7.5
MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To
- Product
- mit-identibot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Improper Privilege ManagementCVE-2023-47683 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.6
- What to do
- Affects up to 7.6.6. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Oceanic is a NodeJS library for interfacing with Discord.CVE-2024-34712 · Other software · OceanicJS · reported by GitHubMedium 6.5
Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library.
- Product
- Oceanic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024kedi ElectronCord is a bot management tool for Discord.CVE-2024-26136 · Other software · kedi · reported by GitHubHigh 7.5
kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` file. Malicious actors could potentially exploit this vulnerability to gain unauthorized access to sensitive information or perform malicious actions on behalf of the repository owner. As of time of publication, it is unknown whether the owner of the repository has rotated the token or taken other mitigation steps aside from informing users of the situation.
- Product
- ElectronCord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2024An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments CVE-2024-23739 · Other software · Discord · reported by MITRECritical 9.8
An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
- Product
- Discord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comelectronjs.org
Jan 17, 2024WP Discord Invite: Does not protect some of its actions against CSRF attacksCVE-2023-5006 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.
- Product
- WP Discord Invite
- Fixed in
- 2.5.1
- What to do
- Update WP Discord Invite to 2.5.1 or newer.
Jan 8, 2024Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server.CVE-2024-21663 · Other software · DEMON1A · reported by GitHubCritical 9.9
Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Nov 5, 2023A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2.CVE-2018-25093 · Other software · Vaerys-Dawn · reported by VulDBMedium 5.5
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484.
- Product
- DiscordSailv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2023A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2.CVE-2018-25092 · Other software · Vaerys-Dawn · reported by VulDBMedium 5.5
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.
- Product
- DiscordSailv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypassCVE-2023-2982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.4
- What to do
- Affects up to 7.6.4. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Apr 21, 2023Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible.CVE-2023-30621 · Other software · Curiosity-org · reported by GitHubCritical 9.8
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The `!ping` command when provided with an IP or hostname used to run a bash `ping <IP>` without verification that the IP or hostname was legitimate. This command was executed with root permissions and may lead to arbitrary command injection on the host server. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Gipsy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023discordrb is an implementation of the Discord API using Ruby.CVE-2023-28102 · Other software · shardlab · reported by GitHubHigh 8.3
discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.
- Product
- discordrb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Jan 2, 2023kenny2automate is a Discord bot.CVE-2023-22452 · Other software · Kenny2github · reported by GitHubMedium 6.5
kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
- Product
- kenny2automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022miniOrange Discord Integration: Does not have authorisation and CSRF in some of its AJAX actionsCVE-2022-3082 · WordPress plugins & themes · reported by WPScanMedium 6.5
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example
- Product
- miniOrange Discord Integration
- Fixed in
- 2.1.6
- What to do
- Update miniOrange Discord Integration to 2.1.6 or newer.
Aug 18, 2022py-cord is a an API wrapper for Discord written in Python.CVE-2022-36024 · Other software · Pycord-Development · reported by GitHubHigh 7.5
py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected. This issue has been patched in version 2.0.1. There are currently no recommended workarounds - please upgrade to a patched version.
- Product
- pycord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializeCVE-2022-25345 · Other software · Discordjs · reported by report@snyk.ioHigh 7.5
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
- Product
- Opus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022DisCatSharp is a Discord API wrapper for .NET.CVE-2022-24849 · Other software · Aiko-IT-Systems · reported by GitHubMedium 6.5
DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two `RequireDisCatSharpDeveloperAttribute`s or the `BaseDiscordClient.LibraryDeveloperTeam` have potentially had their bot token sent to a web server not affiliated with Discord. This server is owned and operated by DisCatSharp's development team. The tokens were not logged, yet it is still advisable to reset the tokens of potentially affected bots. 9.9.1 has been released to patch the issue for the current stable release and the current 10.0.0 prereleases are also no longer affected. Users unable to upgrade should remove all uses of the two `RequireDisCatSharpDeveloperAttribute`s and all direct calls to `BaseDiscordClient.LibraryDeveloperTeam`.
- Product
- DisCatSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot.CVE-2022-23604 · Other software · Twentysix26 · reported by GitHubHigh 8.8
x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.
- Product
- x26-Cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility.CVE-2022-23611 · Other software · bildsben · reported by GitHubHigh 8.1
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
- Product
- iTunesRPC-Remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility.CVE-2022-23609 · Other software · bildsben · reported by GitHubHigh 8.3
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
- Product
- iTunesRPC-Remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music.CVE-2022-23603 · Other software · Itunesrpc-remastered Project · reported by GitHubCritical 9.9
iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
- Product
- Itunesrpc-remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021Python discord bot is the community bot for the Python Discord community.CVE-2021-41250 · Other software · python-discord · reported by GitHubMedium 4.3
Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0
- Product
- bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021tmerc-cogs are a collection of open source plugins for the Red Discord bot.CVE-2021-37697 · Other software · tmercswims · reported by GitHubHigh 7.1
tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog.
- Product
- tmerc-cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021tmerc-cogs are a collection of open source plugins for the Red Discord bot.CVE-2021-37696 · Other software · tmercswims · reported by GitHubHigh 7.1
tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific MassDM message. Issue is patched in commit 92325be650a6c17940cc52611797533ed95dbbe1. All users are advised to update to the current commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command.
- Product
- tmerc-cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2021Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels.CVE-2021-32646 · Other software · Dav-Git · reported by GitHubMedium 5.3
Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server. Upgrade to version 1.0.1 for a patched version of the cog. As a workaround you may disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable.
- Product
- Dav-Cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021WarnSystem is a cog (plugin) for the Red discord bot.CVE-2021-29502 · Other software · retke · reported by GitHubHigh 7.3
WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type `!warnsysteminfo` to check that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset description` command globally.
- Product
- Laggrons-Dumb-Cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Ticketer is a command based ticket system cog (plugin) for the red discord bot.CVE-2021-29501 · Other software · Dav-Git · reported by GitHubHigh 8.1
Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.
- Product
- Dav-Cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021Kennnyshiwa-cogs contains cogs for Red Discordbot.CVE-2021-29493 · Other software · kennnyshiwa · reported by GitHubMedium 6.5
Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit allows discord users to craft a message that can reveal sensitive and harmful information. Users can upgrade to version 5a84d60018468e5c0346f7ee74b2b4650a6dade7 to receive a patch or, as a workaround, unload tickets to render the exploit unusable.
- Product
- kennnyshiwa-cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2021Discord-Recon is a bot for the Discord chat service.CVE-2021-29466 · Other software · DEMON1A · reported by GitHubMedium 6.5
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file `app.py` and add `.replace('..', '')` into the `Path` variable inside of the `recon` function. The vulnerability is patched in version 0.0.4.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2021Discord-Recon is a bot for the Discord chat service.CVE-2021-29465 · Other software · DEMON1A · reported by GitHubHigh 8.3
Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files on the system. As a workaround, bot maintainers can edit their `setting.py` file then add `<` and `>` into the `RCE` variable inside of it to fix the issue without an update. The vulnerability is patched in version 0.0.4.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2021Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord.CVE-2021-29461 · Other software · DEMON1A · reported by GitHubHigh 8.1
Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.