Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
241 results · page 3 of 5
Oct 27, 2025A flaw has been found in abhicodebox ModernShop 20250922.CVE-2025-12267 · Other software · abhicodebox · reported by VulDBLow 2.1
A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
- Product
- ModernShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).CVE-2025-0276 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
- Product
- BigFix Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control.CVE-2025-0274 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
- Product
- BigFix Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 1, 2025TS3 Manager is modern web interface for maintaining Teamspeak3 servers.CVE-2025-61583 · Other software · joni1802 · reported by GitHubMedium 4.3
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.
- Product
- ts3-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025TS3 Manager is modern web interface for maintaining Teamspeak3 servers.CVE-2025-61582 · Other software · joni1802 · reported by GitHubHigh 7.5
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2.
- Product
- ts3-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Qyrr – simply and modern QR-Code creation: Arbitrary file uploadsCVE-2025-10000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_file() function in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Qyrr – simply and modern QR-Code creation
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Qyrr – simply and modern QR-Code creation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2025esm.sh is a nobuild content delivery network(CDN) for modern web development.CVE-2025-59342 · Other software · esm-dev · reported by GitHubMedium 5.5
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
- Product
- esm.sh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025esm.sh is a nobuild content delivery network(CDN) for modern web development.CVE-2025-59341 · Other software · esm-dev · reported by GitHubHigh 7.7
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
- Product
- esm.sh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.CVE-2025-58064 · Other software · ckeditor · reported by GitHubLow 2.3
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered by a specific user action (leading to unauthorized JavaScript code execution) if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects installations where the editor configuration meets one of the following criteria: the HTML embed plugin is enabled, or there is a custom plugin introducing an editable element where view RawElement is enabled. This issue is fixed in versions 45.2.2 and 46.0.3 of both ckeditor5 and ckeditor5-clipboard.
- Product
- ckeditor5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2025-55162 · Other software · envoyproxy · reported by GitHubMedium 6.3
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required Secure attribute to the Set-Cookie header during deletion. Modern browsers ignore this invalid request, causing the session cookie to persist. This allows a user to remain logged in after they believe they have logged out, creating a session hijacking risk on shared computers. The current implementation iterates through the configured cookie names to generate deletion headers but does not check for these prefixes. This failure to properly construct the deletion header means the user's session cookies are never removed by the browser, leaving the session active and allowing the next user of the same browser to gain unauthorized access to the original user's account and data. This is fixed in versions 1.32.10, 1.33.7, 1.34.5 and 1.35.1.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2025-54588 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure.CVE-2025-55740 · Other software · Anipaleja · reported by GitHubMedium 6.5
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
- Product
- nginx-defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates.CVE-2025-55299 · Other software · 7ritn · reported by GitHubCritical 9.4
VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1.
- Product
- VaulTLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Modernize: Missing AuthorizationCVE-2025-53343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modernize: from n/a through <= 3.4.0.
- Product
- Modernize
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Modernize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Modernize: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.
- Product
- Modernize
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Modernize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2025Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects.CVE-2025-54884 · Other software · DavidOsipov · reported by GitHubHigh 8.7
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecureRandomInt functions in security-kit versions prior to 3.5.0 (packaged in Vision UI 1.4.0 and below) are vulnerable to Denial of Service (DoS) attacks. The generateSecureId(length) function directly used the length parameter to size a Uint8Array buffer, allowing attackers to exhaust server memory through repeated requests for large IDs since the previous 1024 limit was insufficient. The getSecureRandomInt(min, max) function calculated buffer size based on the range between min and max, where large ranges caused excessive memory allocation and CPU-intensive rejection-sampling loops that could hang the thread. This issue is fixed in version 1.5.0.
- Product
- Vision-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects.CVE-2025-54883 · Other software · DavidOsipov · reported by GitHubCritical 9.3
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in security-kit versions prior to 3.5.0 (packaged in Vision-ui <= 1.4.0) contains a critical cryptographic weakness. Due to a silent 32-bit integer overflow in its internal masking logic, the function fails to produce a uniform distribution of random numbers when the requested range between min and max is larger than 2³². The root cause is the use of a 32-bit bitwise left-shift operation (<<) to generate a bitmask for the rejection sampling algorithm. This causes the mask to be incorrect for any range requiring 32 or more bits of entropy. This issue is fixed in version 1.5.0.
- Product
- Vision-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI.CVE-2025-53528 · Other software · zmievsa · reported by GitHubHigh 7.6
Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
- Product
- cadwyn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025Modern Events Calendar Lite: SQL InjectionCVE-2021-4458 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
- Product
- Modern Events Calendar Lite
- Affected
- up to 6.3.0
- What to do
- Affects up to 6.3.0. Update Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 26, 2025Modern Design Library: Stored Cross-Site ScriptingCVE-2025-5842 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Modern Design Library
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Modern Design Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Modern Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.
- Product
- Modern Footnotes
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Modern Events Calendar Lite: Full Path DisclosureCVE-2025-5733 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Modern Events Calendar Lite
- Affected
- up to 7.21.9
- What to do
- Affects up to 7.21.9. Update Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwebnus.networdpress.org
May 30, 2025Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modernCVE-2024-23589 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modern hardware such as GPUs or ASICs
- Product
- HCL Glovius Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Madara – Responsive and modern WordPress theme for manga sites
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmangabooth.comwordfence.com
May 6, 2025phpgt/Dom provides access to modern DOM APIs.CVE-2025-46820 · Websites & servers · phpgt · reported by GitHubHigh 7.1
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the GitHub API to push malicious code or rewrite release commits in your repository. Any downstream user of the repository may be affected, but the token should only be valid for the duration of the workflow run, limiting the time during which exploitation could occur. Version 4.1.8 fixes the issue.
- Product
- Dom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial cCVE-2024-57698 · Other software · Modernwms · reported by MITREHigh 7.5
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the /user/list?culture=en-us endpoint.
- Product
- Modernwms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025Modern Polls: Cross-Site Request Forgery (CSRF)CVE-2025-46466 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0.10.
- Product
- Modern Polls
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Modern Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2025Dell ThinOS 2408 and prior, contains an improper permissions vulnerability.CVE-2025-27688 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0.CVE-2025-2147 · Other software · Beijing Zhide Intelligent Internet Technology · reported by VulDBMedium 6.9
A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Modern Farm Digital Integrated Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.CVE-2025-26331 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0.CVE-2025-1644 · Other software · Benner · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 1.2.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability was found in Benner ModernaNet up to 1.1.0.CVE-2025-1643 · Other software · Benner · reported by VulDBMedium 5.3
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability was found in Benner ModernaNet up to 1.1.0.CVE-2025-1642 · Other software · Benner · reported by VulDBMedium 5.3
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability was found in Benner ModernaNet up to 1.1.0.CVE-2025-1641 · Other software · Benner · reported by VulDBMedium 6.9
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0&_=1739371223797. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical.CVE-2025-1640 · Other software · Benner · reported by VulDBMedium 6.9
A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.CVE-2025-25299 · Other software · ckeditor · reported by GitHubLow 2.3
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- ckeditor5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Feb 18, 2025PressMart - Modern Elementor WooCommerce: Arbitrary shortcode executionCVE-2024-13797 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- PressMart - Modern Elementor WooCommerce
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update PressMart - Modern Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 3, 2025Django-Unicorn adds modern reactive component functionality to Django templates.CVE-2025-24370 · Other software · adamghill · reported by GitHubCritical 9.3
Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- django-unicorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025next-forge is a Next.js project boilerplate for modern web application.CVE-2025-23027 · Other software · haydenbleasel · reported by GitHubMedium 6.3
next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems.
- Product
- next-forge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.CVE-2024-53290 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability.CVE-2024-53289 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() andCVE-2024-53092 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq resources by virtio_pci_vq_info pointer. The info pointer of admin vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[]. Using the info pointer from vp_dev->vqs[] for admin vq causes a kernel NULL pointer dereference bug. In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer from vp_dev->admin_vq.info for admin vq to clean up the resources. Also make info ptr as argument of vp_del_vq() to be symmetric with vp_setup_vq(). vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] Call Trace: <TASK> ... ? vp_reset+0x57/0x90 [virtio_pci] ? vp_reset+0x38/0x90 [virtio_pci] virtio_reset_device+0x1d/0x30 remove_vq_common+0x1c/0x1a0 [virtio_net] virtnet_remove+0xa1/0xc0 [virtio_net] virtio_dev_remove+0x46/0xa0 ... virtio_pci_dr
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 21, 2024In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads.CVE-2024-45194 · Email & office · Synacor · reported by MITREMedium 4.8
In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when interacting with specific elements in the web interface. (The vulnerability can be mitigated by properly sanitizing input parameters to prevent the injection of malicious code.)
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Oct 16, 2024Kaswara Modern VC Addons: Authorization bypassCVE-2021-4448 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
- Product
- Kaswara Modern VC Addons
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Kaswara Modern VC Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Oct 4, 2024Easy Demo Importer – A Modern One-Click Demo Import Solution: Stored Cross-Site ScriptingCVE-2024-9071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy Demo Importer – A Modern One-Click Demo Import Solution
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Easy Demo Importer – A Modern One-Click Demo Import Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 10, 2024Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin.CVE-2024-42423 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized actions leading to information disclosure and tampering.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.CVE-2024-42427 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024Modern Events Calendar: Server-Side Request ForgeryCVE-2024-6522 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Modern Events Calendar
- Affected
- up to 7.12.1
- What to do
- Affects up to 7.12.1. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmec.webnus.netplugins.trac.wordpress.org
Jul 9, 2024Modern Events Calendar: Arbitrary file uploadsCVE-2024-5441 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
- Product
- Modern Events Calendar
- Affected
- up to 7.11.0
- What to do
- Affects up to 7.11.0. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwebnus.networdfence.com
Jun 13, 2024A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the diCVE-2023-35860 · Other software · moderncampus · reported by MITREMedium 5.3
A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the dir parameter to listing.php or rss.php.
- Product
- omni_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlp.constantcontactpages.comlp.constantcontactpages.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.