Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,206 results · page 20 of 25
Apr 18, 2022The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in tCVE-2021-25120 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues
- Fixed in
- 6.2.7
- What to do
- Update the plugin to 6.2.7 or newer.
Apr 11, 2022Social Media Feather: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4
- Product
- Social Media Feather
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting.CVE-2021-39068 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.
- Product
- Curam Social Program Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
- Product
- Easy Social Icons
- Fixed in
- 3.2.1
- What to do
- Update Easy Social Icons to 3.2.1 or newer.
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.30
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Apr 8, 2022Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php.CVE-2022-27349 · Other software · Socialcodia · reported by MITREHigh 7.2
Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Social Codia SMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 8, 2022Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php.CVE-2022-27348 · Other software · Socialcodia · reported by MITREMedium 4.8
Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.
- Product
- Social Codia SMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
- Product
- Easy Social Icons
- Fixed in
- 3.1.4
- What to do
- Update Easy Social Icons to 3.1.4 or newer.
Mar 28, 2022Social Sharing: Does not escape the viewed post URL before outputting it back in onclick attributesCVE-2021-24746 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Sharing
- Fixed in
- 3.3.40
- What to do
- Update Social Sharing to 3.3.40 or newer.
Mar 27, 2022WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarilyCVE-2022-26254 · Other software · Wowonder · reported by MITREMedium 5.3
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.
- Product
- Wowonder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- WP Voting Contest
- Fixed in
- 3.0
- What to do
- Update WP Voting Contest to 3.0 or newer.
Feb 16, 2022BookWyrm is a decentralized social network for tracking reading habits and reviewing books.CVE-2022-23644 · Other software · bookwyrm-social · reported by GitHubHigh 8.8
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The problem has been patched and administrators should upgrade to version 0.3.0 As a workaround, BookWyrm instances can close registration and limit members to trusted individuals.
- Product
- bookwyrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
- Product
- All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
- Fixed in
- 2.0.4
- What to do
- Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.25
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.24
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.1
- What to do
- Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
- Product
- 10Web Social Photo Feed
- Fixed in
- 1.4.29
- What to do
- Update 10Web Social Photo Feed to 1.4.29 or newer.
Dec 21, 2021Blog2Social: Social Media Auto Post & Scheduler: Does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin pageCVE-2021-24956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 6.8.7
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 6.8.7 or newer.
Dec 20, 2021HumHub is an open-source social network kit written in PHP.CVE-2021-43847 · Other software · humhub · reported by GitHubMedium 6.5
HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineerCVE-2021-45099 · Other software · SSH & Web Terminal Project · reported by MITREHigh 8.8
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
- Product
- SSH & Web Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 29, 2021Smash Balloon Social Post Feed: Did not have any privilege or nonce validation before saving the plugin's settingCVE-2021-24918 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.0.1
- What to do
- Update Smash Balloon Social Post Feed to 4.0.1 or newer.
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- About Author Box
- Fixed in
- 1.0.2
- What to do
- Update About Author Box to 1.0.2 or newer.
Nov 26, 2021Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media ConfiguCVE-2021-36843 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
- Affected
- up to 4.3.5
- What to do
- Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.1.7.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Nov 3, 2021Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.CVE-2020-23126 · Other software · Chamilo · reported by MITREMedium 6.1
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
- Product
- NextScripts: Social Networks Auto-Poster <= 4.3.20
- Affected
- up to 4.3.20
- What to do
- Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 21, 2021Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to desCVE-2021-39321 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
- Product
- Sassy Social Share
- Affected
- 3.3.23 to 3.3.23
- What to do
- Affects 3.3.23 to 3.3.23. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Sep 27, 2021Podlove Podcast Publisher: Contains a 'Social & Donations' module (not activated by default)CVE-2021-24666 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
- Product
- Podlove Podcast Publisher
- Fixed in
- 3.5.6
- What to do
- Update Podlove Podcast Publisher to 3.5.6 or newer.
Sep 14, 2021When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versCVE-2021-38150 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.
- Product
- SAP Business Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 2.19.2
- What to do
- Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Sep 7, 2021Nextcloud Circles is an open source social network built for the nextcloud ecosystem.CVE-2021-37630 · Other software · nextcloud · reported by GitHubMedium 6.5
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Circles is an open source social network built for the nextcloud ecosystem.CVE-2021-32782 · Other software · nextcloud · reported by GitHubMedium 5.8
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user CVE-2021-36696 · Other software · Deskpro · reported by MITREMedium 5.4
Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation.
- Product
- Deskpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file.CVE-2021-39322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
- Product
- Easy Social Icons
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Aug 23, 2021Simple Social Media Share Buttons – Social Sharing for Everyone: Did not escape the align and like_button_size parameters of its SSB shortcodeCVE-2021-24486 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Social Media Share Buttons – Social Sharing for Everyone
- Fixed in
- 3.2.3
- What to do
- Update Simple Social Media Share Buttons – Social Sharing for Everyone to 3.2.3 or newer.
Aug 16, 2021Social Tape: Does not have CSRF checks in placeCVE-2021-24411 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
- Product
- Social Tape
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Social Tape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2021PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache).CVE-2021-37704 · Websites & servers · PHPSocialNetwork · reported by GitHubMedium 5.4
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
- Product
- phpfastcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/iCVE-2021-37391 · Other software · Chamilo · reported by MITREMedium 5.4
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitbook.seguranca-informatica.ptgithub.com
Aug 10, 2021A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).CVE-2021-37390 · Other software · Chamilo · reported by MITREMedium 6.1
A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitbook.seguranca-informatica.ptgithub.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Jul 2, 2021An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36.CVE-2021-36130 · Other software · Mediawiki · reported by MITREMedium 4.8
An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
May 6, 2021Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a CVE-2021-32077 · Other software · Veritystream · reported by MITREHigh 7.5
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII.
- Product
- Msow Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarbasec.comveritystream.com
Apr 5, 2021Social Slider Widget: Allowed Authenticated Reflected XSS in the plugin settings pageCVE-2021-24196 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
- Product
- Social Slider Widget
- Fixed in
- 1.8.5
- What to do
- Update Social Slider Widget to 1.8.5 or newer.
Full record and what to do →NVD recordpurinechu.github.iowpscan.com
Mar 18, 2021Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, CVE-2021-24143 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.
- Fixed in
- 1.8.1
- What to do
- Update the plugin to 1.8.1 or newer.
Mar 18, 2021Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users CVE-2021-24137 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
- Product
- Blog2Social
- Fixed in
- 6.3.1
- What to do
- Update Blog2Social to 6.3.1 or newer.
Jan 13, 2021Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the weCVE-2021-1246 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Unified Customer Voice Portal (CVP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comtools.cisco.com
Jan 13, 2021Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of CiscCVE-2021-1245 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Unified Customer Voice Portal (CVP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comtools.cisco.com
Jan 4, 2021Creeper is an experimental dynamic, interpreted language.CVE-2020-26292 · Other software · chatter-social · reported by GitHubLow 3.1
Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean.
- Product
- Creeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2021IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorCVE-2020-4942 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.
- Product
- Curam SPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.