Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,282 results · page 24 of 26

Sep 6, 2006Multiple SQL injection vulnerabilities in links.php in ssLinks 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) go parameter and (2) idCVE-2006-4598 · Other software · Sslinks · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in links.php in ssLinks 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) go parameter and (2) id parameter in a rate action.
Product
Sslinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Aug 31, 2006CRLF injection vulnerability in links.php in NX5Linx 1.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks viCVE-2006-4505 · Other software · Nx5 · reported by MITREHigh 7.5
CRLF injection vulnerability in links.php in NX5Linx 1.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a CRLF sequence in the url parameter.
Product
Nx5linx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com evuln.com
Aug 31, 2006Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full administration rightsCVE-2006-4462 · Other software · Gonafish.com · reported by MITREHigh 7.5
Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full administration rights via a direct request to Admin/admin1953.php.
Product
Linkscaffe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securitytracker.com
Aug 26, 2006SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQCVE-2006-4356 · Websites & servers · Drupal · reported by MITREHigh 7.5
SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
Drupal Easylinks Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org secunia.com
Aug 26, 2006Cross-site scripting (XSS) vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to inject CVE-2006-4355 · Websites & servers · Drupal · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Drupal Easylinks Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org secunia.com
Aug 23, 2006SQL injection vulnerability in admin.php in CloudNine Interactive Links Manager 2006-06-12, when magic_quotes_gpc is disabled, allows remote attackers to executCVE-2006-4328 · Other software · Cloudnine Interactive · reported by MITREMedium 5.1
SQL injection vulnerability in admin.php in CloudNine Interactive Links Manager 2006-06-12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
Product
Links Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record evuln.com secunia.com
Aug 23, 2006Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary CVE-2006-4327 · Other software · Cloudnine Interactive · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, or (3) keywords parameters.
Product
Links Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record evuln.com secunia.com
Aug 4, 2006SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the (1) desCVE-2006-3996 · Other software · Adaptive Technology Resource Centre · reported by MITREMedium 6.5
SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the (1) desc or (2) asc parameters.
Product
Atutor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atutor.ca retrogod.altervista.org
Aug 1, 2006PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for Mambo allows remote attackers to execute arbitrary CVE-2006-3949 · Other software · Mambo · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Product
Artlinks Component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Jul 31, 2006SQL injection vulnerability in links.php in Gonafish LinksCaffe 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.CVE-2006-3932 · Other software · Gonafish · reported by MITREMedium 5.1
SQL injection vulnerability in links.php in Gonafish LinksCaffe 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Product
Linkscaffe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com vupen.com
Jul 26, 2006Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the tablewiCVE-2006-3883 · Other software · Gonafish · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the tablewidth parameter in (a) counter.php; (2) the newdays parameter in (b) links.php; and the (3) tableborder, (4) menucolor, (5) textcolor, and (6) bodycolor parameters in (c) menu.inc.php.
Product
Linkscaffe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jul 26, 2006Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) offset and (CVE-2006-3884 · Other software · Gonafish · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) offset and (2) limit parameters, (3) newdays parameter in a new action, and the (4) link_id parameter in a deadlink action. NOTE: this issue can also be used for path disclosure by a forced SQL error, or to modify PHP files using OUTFILE.
Product
Linkscaffe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jul 12, 2006SQL injection vulnerability in Meine Links (aka My Links) in Kyberna ky2help allows remote authenticated users to execute arbitrary SQL commands via unspecifiedCVE-2006-3541 · Other software · Kyberna · reported by MITREMedium 6.5
SQL injection vulnerability in Meine Links (aka My Links) in Kyberna ky2help allows remote authenticated users to execute arbitrary SQL commands via unspecified "textboxes."
Product
Ky2help
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Jun 27, 2006SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the CVE-2006-3263 · Other software · Mambo · reported by MITREHigh 7.5
SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Product
Mambo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mamboserver.com mamboserver.com
Jun 27, 2006SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the CVE-2006-3262 · Other software · Mambo · reported by MITREHigh 7.5
SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
Product
Mambo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record retrogod.altervista.org secunia.com
Jun 12, 2006Cross-site scripting (XSS) vulnerability in search.php in OkScripts QuickLinks 1.1 allows remote attackers to inject arbitrary web script or HTML via the q paraCVE-2006-2999 · Other software · Okscripts · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search.php in OkScripts QuickLinks 1.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Product
Quicklinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jun 8, 2006SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.CVE-2006-2904 · Other software · Particle Soft · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Product
Particle Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 8, 2006Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php, which displays CVE-2006-2905 · Other software · Particle Soft · reported by MITREMedium 5
Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php, which displays the path in an error message.
Product
Particle Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 8, 2006Directory traversal vulnerability in Particle Links 1.2.2 might allow remote attackers to access arbitrary files via ".." sequences in an HTTP request.CVE-2006-2902 · Other software · Particle Soft · reported by MITREMedium 5
Directory traversal vulnerability in Particle Links 1.2.2 might allow remote attackers to access arbitrary files via ".." sequences in an HTTP request. NOTE: it is not clear whether this issue is legitimate, as the original researcher seems unsure.
Product
Particle Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jun 8, 2006Cross-site scripting (XSS) vulnerability in admin.php in Particle Links 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the username paCVE-2006-2903 · Other software · Particle Soft · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in admin.php in Particle Links 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Product
Particle Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 6, 2006SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.CVE-2006-2847 · Other software · Full Revolution · reported by MITREHigh 7.5
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.
Product
Aspweblinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 6, 2006links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePasswCVE-2006-2848 · Other software · Full Revolution · reported by MITREMedium 5
links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePassword field.
Product
Aspweblinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exploit-db.com
Jun 6, 2006Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki 2.1.6 and earlier allows remote attackers to inject arbitrary web scriCVE-2006-2840 · Other software · Pmwiki · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Product
Pmwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com pmwiki.org
May 25, 2006SQL injection vulnerability in Destiney Links Script 2.1.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter.CVE-2006-2585 · Other software · Greg Donald · reported by MITREMedium 6.4
SQL injection vulnerability in Destiney Links Script 2.1.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Destiney Links Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com vupen.com
May 24, 2006SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows remote attackers to execute arbitrary SQCVE-2006-2569 · Other software · 4r Linklist · reported by MITREHigh 7.5
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Product
4r Linklist
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
May 23, 2006Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a mCVE-2006-2559 · Network & remote access · Linksys · reported by MITREHigh 7.5
Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Product
Wrt54g
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
May 22, 2006Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to CVE-2006-2534 · Other software · Greg Donald · reported by MITREMedium 5
Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to files in the (1) include and (2) themes/original directories.
Product
Destiney Links Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
May 22, 2006Cross-site scripting (XSS) vulnerability in Destiney Links Script 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) "Search" (terCVE-2006-2536 · Other software · Greg Donald · reported by MITREMedium 5.8
Cross-site scripting (XSS) vulnerability in Destiney Links Script 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) "Search" (term parameter in index.php) and (2) "Add a Site" (add.php) fields.
Product
Destiney Links Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 22, 2006index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, CVE-2006-2535 · Other software · Greg Donald · reported by MITREMedium 5
index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message. NOTE: this issue might be resultant from a more serious issue such as directory traversal.
Product
Destiney Links Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 15, 2006SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid paraCVE-2006-2363 · Other software · Limbo CMS · reported by MITREMedium 5.1
SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Product
Limbo CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.limboforge.org secunia.com
May 12, 2006BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links.CVE-2006-1440 · Computers, phones & browsers · Apple · reported by MITRELow 2.1
BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com secunia.com
May 4, 2006Multiple cross-site scripting (XSS) vulnerabilities in links.php in PHP Linkliste 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1)CVE-2006-2176 · Websites & servers · PHP Design X · reported by MITREMedium 5.8
Multiple cross-site scripting (XSS) vulnerabilities in links.php in PHP Linkliste 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) new_input, (2) new_url, or (3) new_name parameter.
Product
PHP Linkliste
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record d4igoro.blogspot.com secunia.com
Apr 21, 2006Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation ProtocolCVE-2006-1973 · Network & remote access · Linksys · reported by MITREMedium 5
Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation Protocol (SIP) messages.
Product
Rt31p2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com kb.cert.org
Apr 18, 2006Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the terCVE-2006-1825 · Websites & servers · Phplinks · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.
Product
Phplinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pridels0.blogspot.com securityfocus.com
Apr 17, 2006Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions beforCVE-2006-1796 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).
Fixed in
2.0.1
What to do
Update the plugin to 2.0.1 or newer.
Full record and what to do →NVD record bugs.debian.org trac.wordpress.org
Apr 5, 2006Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameteCVE-2006-1622 · Websites & servers · Phpselect · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.
Product
Phpselect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Mar 7, 2006Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel,CVE-2006-1067 · Network & remote access · Linksys · reported by MITREMedium 5
Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.
Product
Wrt54g V5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hm2k.org securityfocus.com
Feb 27, 2006SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogCVE-2006-0906 · Other software · TOP Line · reported by MITREHigh 7.5
SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php.
Product
D3jeeb Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Jan 18, 2006Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP opCVE-2006-0309 · Network & remote access · Linksys · reported by MITREMedium 4
Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length.
Product
Befvp41
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Jan 3, 2006SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username paramCVE-2006-0067 · Other software · Vego · reported by MITREHigh 7.5
SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
Product
Vego Links Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record evuln.com secunia.com
Dec 31, 2005OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, whichCVE-2005-4636 · Other software · Openoffice · reported by MITREMedium 4.6
OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings.
Product
Openoffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qa.openoffice.org securitytracker.com
Dec 15, 2005Linksys WRT54GS and BEFW11S4 allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and pCVE-2005-4257 · Network & remote access · Linksys · reported by MITREHigh 7.8
Linksys WRT54GS and BEFW11S4 allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LAND). NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.
Product
Befw11s4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Dec 6, 2005Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to searcCVE-2005-4042 · Other software · Mr. CGI GUY · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to search.cgi.
Product
Warm Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pridels0.blogspot.com secunia.com
Dec 6, 2005Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary webCVE-2005-4041 · Other software · Mr. CGI GUY · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.
Product
HOT Links Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pridels0.blogspot.com pridels0.blogspot.com
Nov 21, 2005Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in inCVE-2005-3697 · Other software · Uresk Links · reported by MITREHigh 7.5
Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in index.php.
Product
Uresk Links
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Nov 18, 2005Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links,CVE-2005-2929 · Other software · University Of Kansas · reported by MITREHigh 7.5
Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links, which are not properly restricted in the default configuration in some environments.
Product
Lynx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.sco.com ftp.sco.com
Oct 27, 2005Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3)CVE-2005-3265 · Other software · Skype Technologies · reported by MITREHigh 9.3
Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3) a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.
Product
Skype
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com skype.com
Oct 5, 2005StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecovCVE-2005-3148 · Other software · Storebackup · reported by MITREMedium 4.6
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
Product
Storebackup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org secunia.com
Sep 15, 2005Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code viaCVE-2005-2799 · Network & remote access · Linksys · reported by MITREHigh 7.5
Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request.
Product
Wrt54g
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record idefense.com idefense.com
Sep 14, 2005Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has beenCVE-2005-2916 · Network & remote access · Linksys · reported by MITREMedium 5
Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has been processed, which allows remote attackers to (1) modify configuration using restore.cgi or (2) upload new firmware using upgrade.cgi.
Product
Wrt54g
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record idefense.com idefense.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.