Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
350 results · page 3 of 7
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.CVE-2025-25514 · Other software · Seacms · reported by MITREMedium 6.5
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php compCVE-2025-22974 · Other software · Seacms · reported by MITRECritical 9.8
SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.CVE-2025-25513 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability was found in AquilaCMS 1.412.13.CVE-2025-0465 · Other software · reported by VulDBMedium 6.9
A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jan 6, 2025SeaCMS V13.1 is vulnerable to Incorrect Access Control.CVE-2024-54880 · Other software · Seacms · reported by MITRECritical 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netseacms.net
Jan 6, 2025SeaCMS V13.1 is vulnerable to Incorrect Access Control.CVE-2024-54879 · Other software · Seacms · reported by MITRECritical 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().CVE-2024-55461 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalatCVE-2024-21939 · Other software · AMD · reported by psirt@amd.comHigh 7.3
Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
- Product
- AMD Cloud Manageability Service Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API.CVE-2024-52004 · Other software · mediacms-io · reported by GitHubHigh 8.7
MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.
- Product
- mediacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handlCVE-2024-50808 · Other software · seacms · reported by MITREHigh 8.8
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "ReseCVE-2024-48573 · Other software · aquila · reported by MITRECritical 9.8
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature.CVE-2024-48572 · Other software · aquila · reported by MITREMedium 5.3
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against email addresses to find duplicate entries.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp.CVE-2024-46640 · Other software · seacms · reported by MITRECritical 9.8
SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.CVE-2024-44721 · Other software · seacms · reported by MITRECritical 9.8
SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.CVE-2024-44720 · Other software · seacms · reported by MITREHigh 7.5
SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Tina is an open-source content management system (CMS).CVE-2024-45391 · Other software · tinacms · reported by GitHubHigh 7.5
Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.CVE-2024-44921 · Other software · seacms · reported by MITRECritical 9.8
SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML viaCVE-2024-44920 · Other software · seacms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.CVE-2024-44683 · Other software · Seacms · reported by MITREMedium 6.1
Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via aCVE-2024-44918 · Other software · seacms · reported by MITRELow 3.5
A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and couCVE-2024-44916 · Other software · seacms · reported by MITREHigh 7.2
Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafteCVE-2024-44919 · Other software · seacms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ad description parameter.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.CVE-2024-41444 · Other software · seacms · reported by MITRECritical 9.8
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 22, 2024SeaCMS 13.0 has a remote code execution vulnerability.CVE-2024-42599 · Other software · seacms · reported by MITREHigh 8.8
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024SeaCMS 13.0 has a remote code execution vulnerability.CVE-2024-42598 · Other software · seacms · reported by MITREMedium 6.7
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2024A vulnerability, which was classified as problematic, was found in SeaCMS 12.9.CVE-2024-7163 · Other software · seacms · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272577 was assigned to this vulnerability.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2024A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0.CVE-2024-7162 · Other software · seacms · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/player/dmplayer/admin/post.php?act=setting. The manipulation of the argument yzm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272576.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2024A vulnerability classified as problematic was found in SeaCMS 13.0.CVE-2024-7161 · Other software · seacms · reported by VulDBMedium 6.9
A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272575.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php.CVE-2024-39036 · Other software · seacms · reported by MITREMedium 6.5
SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024There is a remote code execution vulnerability in SeaCMS 12.9.CVE-2024-40522 · Other software · seacms · reported by MITREHigh 8.8
There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute arbitrary commands and obtain system permissions.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024SeaCMS 12.9 has a remote code execution vulnerability.CVE-2024-40521 · Other software · seacms · reported by MITREHigh 8.8
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024SeaCMS 12.9 has a remote code execution vulnerability.CVE-2024-40520 · Other software · seacms · reported by MITREHigh 8.8
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data into inc_photowatermark_config.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024SeaCMS 12.9 has a remote code execution vulnerability.CVE-2024-40519 · Other software · seacms · reported by MITREHigh 8.8
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024SeaCMS 12.9 has a remote code execution vulnerability.CVE-2024-40518 · Other software · seacms · reported by MITREHigh 8.8
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.CVE-2024-39028 · Other software · seacms · reported by MITRECritical 9.8
An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024SeaCMS v12.9 has an unauthorized SQL injection vulnerability.CVE-2024-39027 · Other software · seacms · reported by MITREHigh 7.5
SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2024A vulnerability was found in SeaCMS 12.9.CVE-2024-6416 · Other software · Seacms · reported by VulDBMedium 5.3
A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270007.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comvuldb.com
Jun 10, 2024SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.CVE-2024-31611 · Other software · seacms · reported by MITRECritical 9.1
SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.CVE-2024-30565 · Other software · seacms · reported by MITREHigh 8.8
An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the iCVE-2024-29275 · Other software · seacms · reported by MITRECritical 9.8
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/publicCVE-2024-28715 · Other software · Html-js · reported by MITREHigh 8.8
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.CVE-2023-51840 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' paCVE-2020-26625 · Other software · Gilacms · reported by MITRELow 3.8
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameterCVE-2020-26624 · Other software · Gilacms · reported by MITRELow 3.8
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under theCVE-2020-26623 · Other software · Gilacms · reported by MITRELow 3.8
SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-50470 · Other software · Seacms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netseacms.net
Dec 28, 2023SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.CVE-2023-46987 · Other software · Seacms · reported by MITREHigh 8.8
SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseacms.comblog.csdn.net
Dec 20, 2023SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table CVE-2023-47990 · Other software · Cuppacms · reported by MITRECritical 9.8
SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatarCVE-2023-49444 · Other software · Html-js · reported by MITREMedium 5.4
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords.CVE-2023-49443 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.