Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
299 results · page 3 of 6
Jun 27, 2025The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another userCVE-2025-5526 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
- Product
- BuddyPress Docs
- Fixed in
- 2.2.5
- What to do
- Update BuddyPress Docs to 2.2.5 or newer.
Jun 13, 2025An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-fCVE-2025-4227 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 1
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel. An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.
- Product
- GlobalProtect App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI CVE-2025-5301 · Other software · OnlyOffice · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
- Product
- Docs (DocumentServer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comr.sec-consult.com
Jun 6, 2025DocsPress: Missing AuthorizationCVE-2025-49240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.
- Product
- DocsPress
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update DocsPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025EazyDocs: Missing AuthorizationCVE-2025-32221 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.7.1.
- Product
- EazyDocs
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WP Docs: Missing AuthorizationCVE-2025-31417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through < 2.2.7.
- Product
- WP Docs
- What to do
- Update WP Docs to the newest version.
Mar 14, 2025WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpCVE-2025-29782 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.2.17 contains a patch for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT.CVE-2025-0868 · Other software · Arc53 · reported by cvd@cert.plCritical 9.3
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0.
- Product
- DocsGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, causCVE-2024-23563 · Other software · HCL Software · reported by psirt@hcl.comLow 3.9
HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
- Product
- Connections Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Feb 6, 2025In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolenCVE-2024-39033 · Other software · reported by MITREHigh 7.5
In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Document Block – Upload & Embed Docs: Missing AuthorizationCVE-2025-22696 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.
- Product
- Document Block – Upload & Embed Docs
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Document Block – Upload & Embed Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 17, 2025Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including ChromiumCVE-2024-52870 · Other software · reported by MITREHigh 7.1
Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromium Developer Tools) that can result in a client user accessing arbitrary remote websites.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchrismanson.comteradata.com
Jan 7, 2025WP Docs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56288 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs wp-docs allows Stored XSS.This issue affects WP Docs: from n/a through <= 2.2.1.
- Product
- WP Docs
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025EazyDocs: Missing AuthorizationCVE-2023-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.3.5.
- Product
- EazyDocs
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024WP Docs: Time-based SQL InjectionCVE-2024-12635 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability was partially patched in version 2.2.0.
- Product
- WP Docs
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024EazyDocs: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54376 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider Themes EazyDocs eazydocs allows PHP Local File Inclusion.This issue affects EazyDocs: from n/a through <= 2.8.0.
- Product
- EazyDocs
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024ONLYOFFICE DocSpace: Stored Cross-Site ScriptingCVE-2024-11750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE DocSpace
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update ONLYOFFICE DocSpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024BetterDocs: Missing AuthorizationCVE-2023-47762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.
- Product
- BetterDocs
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Docs: Missing AuthorizationCVE-2023-30873 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.
- Product
- WP Docs
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024ONLYOFFICE Docs: Stored Cross-Site ScriptingCVE-2024-11450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE Docs
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024Knowledge Base documentation & wiki plugin – BasePress Docs: Unauthorized modification of dataCVE-2024-10664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.
- Product
- Knowledge Base documentation & wiki plugin – BasePress Docs
- Affected
- up to 2.16.3.3
- What to do
- Affects up to 2.16.3.3. Update Knowledge Base documentation & wiki plugin – BasePress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2024The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin forCVE-2024-11203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2024WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser.CVE-2024-53930 · Other software · reported by MITREMedium 5.4
WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.CVE-2024-48463 · Other software · usebruno · reported by MITREMedium 6.5
Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 1, 2024EazyDocs: Missing AuthorizationCVE-2024-38721 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in spider-themes EazyDocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through 2.5.0.
- Product
- EazyDocs
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Google Docs RSVP: Cross-Site Request Forgery (CSRF)CVE-2024-49672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through <= 2.0.1.
- Product
- Google Docs RSVP
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Google Docs RSVP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2024BuddyPress Docs: Reflected Cross-Site ScriptingCVE-2024-9207 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- BuddyPress Docs
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update BuddyPress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0.CVE-2024-8784 · Other software · QDocs · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users[] with the input 1'+AND+(SELECT+3220+FROM+(SELECT(SLEEP(5)))ZNun)+AND+'WwBM'%3d'WwBM as part of POST Request Parameter leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Smart School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Sep 9, 2024ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro.CVE-2024-44085 · Other software · onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by direCVE-2023-50883 · Other software · onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.phpCVE-2024-41369 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.phpCVE-2024-41368 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.phpCVE-2024-41367 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.phpCVE-2024-41366 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.phpCVE-2024-41364 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.phpCVE-2024-41361 · Other software · sourcefabric · reported by MITRECritical 9.8
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
- Product
- rpi-jukebox-rfid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read fileCVE-2024-45241 · Other software · centralsquare · reported by MITREHigh 7.5
A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information.
- Product
- crywolf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024BetterDocs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43129 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
- Product
- BetterDocs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024BetterDocs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43227 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issue affects BetterDocs: from n/a through 3.5.8.
- Product
- BetterDocs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2024Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability.CVE-2024-37403 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 5.5
Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.
- Product
- Docs@Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024EazyDocs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38720 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EazyDocs eazydocs allows Stored XSS.This issue affects EazyDocs: from n/a through 2.5.0.
- Product
- EazyDocs
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 2, 2024EazyDocs: Does not sanitise and escape some of its settingsCVE-2024-3999 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EazyDocs
- Fixed in
- 2.5.0
- What to do
- Update EazyDocs to 2.5.0 or newer.
Jun 13, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2024-1565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the PDF Widget URL in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.9.10
- What to do
- Affects up to 3.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2024weDocs: Missing AuthorizationCVE-2024-34442 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weDocs.This issue affects weDocs: from n/a through 2.1.4.
- Product
- weDocs
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024WP Docs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This issue affects WP Docs: from n/a through 2.1.3.
- Product
- WP Docs
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024WP Docs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35695 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue affects WP Docs: from n/a through 2.1.3.
- Product
- WP Docs
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code.CVE-2023-45707 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.4
HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.
- Product
- Connections Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 5, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-5571 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's EmbedPress PDF widget in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 3, 2024A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbiCVE-2024-34051 · Other software · dolibarr · reported by MITREMedium 4.6
A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.smarttecs.comblog.smarttecs.com
May 30, 2024A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file.CVE-2024-3924 · Other software · huggingface · reported by security@huntr.devMedium 4.4
A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulnerability arises from the insecure handling of the `github.head_ref` user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0.
- Product
- huggingface/text-generation-inference
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.