Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,712 results · page 22 of 35
Feb 21, 2023Intuitive Custom Post Order: Does not check for authorization in the update-menu-order ajax actionCVE-2022-4385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 19, 2023MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, aCVE-2022-48329 · Other software · Misp-project · reported by MITRECritical 9.8
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2023app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.CVE-2022-48328 · Other software · Misp-project · reported by MITRECritical 9.8
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.CVE-2023-23279 · Other software · Canteen Management System Project · reported by MITRECritical 9.8
Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.CVE-2021-38239 · Other software · Dataease · reported by MITREHigh 7.5
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.CVE-2023-24647 · Other software · Oretnom23 · reported by MITREHigh 7.5
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafteCVE-2023-24646 · Other software · Oretnom23 · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows atCVE-2023-24233 · Other software · Inventory Management System Project · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter.
- Product
- Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.CVE-2023-24197 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.CVE-2023-24195 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.CVE-2023-24194 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.CVE-2023-24192 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.CVE-2023-24191 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 3, 2023WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes.CVE-2022-42909 · Other software · WEPA · reported by cve-coordination@incibe.esMedium 6.5
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
- Product
- Wepa Print Away
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenrique.wtfincibe-cert.es
Feb 1, 2023In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsinCVE-2023-23969 · Other software · Djangoproject · reported by MITREHigh 7.5
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jan 24, 2023B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerabilityCVE-2022-4554 · Other software · ID Software Project and Consultancy Services · reported by iletisim@usom.gov.trMedium 5.4
B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347.
- Product
- B2B Customer Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 23, 2023OneClick Chat to Order: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- OneClick Chat to Order
- Fixed in
- 1.0.4.2
- What to do
- Update OneClick Chat to Order to 1.0.4.2 or newer.
Jan 20, 2023Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.CVE-2020-29297 · Other software · Oretnom23 · reported by MITRECritical 9.8
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 11, 2023Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.CVE-2022-47865 · Other software · Lead Management System Project · reported by MITRECritical 9.8
Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.
- Product
- Lead Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-orderCVE-2022-4162 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-order.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 22, 2022Due to a layout change, iframe contents could have been rendered outside of its border.CVE-2022-28286 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 19, 2022DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability.CVE-2022-42945 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system.
- Product
- DWG Trueview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Dec 2, 2022Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.CVE-2022-44348 · Other software · Sanitization Management System Project · reported by MITREHigh 7.2
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2022Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.CVE-2022-44295 · Other software · Sanitization Management System Project · reported by MITREHigh 7.2
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.CVE-2022-44400 · Other software · Purchase Order Management System Project · reported by MITRECritical 9.8
Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
- Product
- Purchase Order Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php.CVE-2022-43213 · Other software · Billing System Project Project · reported by MITRECritical 9.8
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php.
- Product
- Billing System Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Nov 22, 2022Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.CVE-2022-43212 · Other software · Billing System Project Project Project · reported by MITRECritical 9.8
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.
- Product
- Billing System Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Nov 21, 2022Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php.CVE-2022-43215 · Other software · Billing System Project · reported by MITRECritical 9.8
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php.
- Product
- Billing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Nov 21, 2022Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.CVE-2022-43214 · Other software · Billing System Project · reported by MITRECritical 9.8
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.
- Product
- Billing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Nov 14, 2022Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.CVE-2022-43288 · Other software · Rukovoditel · reported by MITREHigh 8.8
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2022Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name.CVE-2022-45196 · Other software · Hyperledger · reported by MITREHigh 7.5
Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist.
- Product
- Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.CVE-2022-40128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 7, 2022Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.CVE-2022-43046 · Other software · Oretnom23 · reported by MITREMedium 4.8
Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
- Product
- Food Ordering Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20CustCVE-2022-42990 · Other software · Oretnom23 · reported by MITREHigh 7.2
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
- Product
- Food Ordering Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Restaurant Menu – Food Ordering System – Table Reservation: Cross-Site Request ForgeryCVE-2022-3776 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Restaurant Menu – Food Ordering System – Table Reservation
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 3, 2022Restaurant Menu – Food Ordering System – Table Reservation: Authorization bypassCVE-2022-2696 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes it possible for authenticated attackers with minimal permissions to perform a wide variety of actions such as modifying the plugin's settings and modifying the ordering system preferences.
- Product
- Restaurant Menu – Food Ordering System – Table Reservation
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 2, 2022Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php.CVE-2022-41551 · Other software · Garage Management System Project · reported by MITREHigh 7.2
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php.
- Product
- Garage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php_action/printOrder.php.CVE-2022-43331 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php_action/printOrder.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.CVE-2022-43330 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.CVE-2022-43328 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022A cross-site scripting (XSS) vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTMLCVE-2022-43082 · Other software · Fast Food Ordering System Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.CVE-2022-43081 · Other software · Fast Food Ordering System Project · reported by MITREHigh 7.5
Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.
- Product
- Fast Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/manage_request.CVE-2022-43354 · Other software · Sanitization Management System Project · reported by MITREHigh 7.2
Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/manage_request.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.CVE-2022-43353 · Other software · Sanitization Management System Project · reported by MITREHigh 7.2
Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
- Product
- Sanitization Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchOrderData.php.CVE-2022-43232 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchOrderData.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.CVE-2022-43014 · Other software · Opencats · reported by MITREMedium 6.1
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43433 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins ScreenRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 14, 2022In Soundrecorder service, there is a missing permission check.CVE-2022-39107 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.