Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

199 results · page 3 of 4

Jan 15, 2024Estatik Real Estate: Does not sanitise and escape various parameters and generated URLs before outputting them back in attributesCVE-2023-6050 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Estatik Real Estate
Fixed in
4.1.1
What to do
Update Estatik Real Estate to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Estatik Real Estate: Unserializes user input via some of its cookiesCVE-2023-6049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
Product
Estatik Real Estate
Fixed in
4.1.1
What to do
Update Estatik Real Estate to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Estatik Real Estate: Does not prevent user with low privileges on the siteCVE-2023-6048 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset
Product
Estatik Real Estate
Fixed in
4.1.1
What to do
Update Estatik Real Estate to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0.CVE-2024-0543 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of the file propertydetail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250713 was assigned to this vulnerability.
Product
Real Estate Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com vuldb.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6141 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not prevent users with limited privileges on the siteCVE-2023-6140 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6139 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2023Houzez - Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29432 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.
Product
Houzez - Real Estate
Fixed in
2.8.3
What to do
Update Houzez - Real Estate to 2.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Essential Real Estate: Arbitrary file uploadsCVE-2023-6827 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.
Product
Essential Real Estate
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2023Houzez - Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36529 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.
Product
Houzez - Real Estate
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Houzez - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 8, 2023Real Estate Manager: Privilege escalationCVE-2023-4239 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Product
Real Estate Manager
Affected
up to 7.2
What to do
Affects up to 7.2. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 20, 2023A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3795 · Other software · Bug Finder · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /property of the component GET Parameter Handler. The manipulation of the argument name leads to sql injection. The associated identifier of this vulnerability is VDB-235063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
ChainCity Real Estate Investment Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Jul 20, 2023A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0.CVE-2023-3794 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. VDB-235062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
ChainCity Real Estate Investment Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Dec 12, 2022Essential Real Estate: Does not sanitize and escapes some parametersCVE-2022-3933 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
Product
Essential Real Estate
Fixed in
3.9.6
What to do
Update Essential Real Estate to 3.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 16, 2022A vulnerability was found in Itech Real Estate Script 3.12.CVE-2017-20130 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Product
Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com exploit-db.com
May 30, 2022Simple Real Estate Pack: Does not sanitise and escape some of its settingsCVE-2022-1646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Simple Real Estate Pack
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Simple Real Estate Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 21, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent.CVE-2022-28411 · Other software · Simple Real Estate Portal System Portal · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent.CVE-2022-28410 · Other software · Simple Real Estate Portal System Project · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate.CVE-2022-28030 · Other software · Simple Real Estate Portal System Project · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type.CVE-2022-28029 · Other software · Simple Real Estate Portal System Project · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity.CVE-2022-28028 · Other software · Simple Real Estate Portal System Project · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 2, 2022Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.CVE-2022-25399 · Other software · Simple Real Estate Portal System Project · reported by MITRECritical 9.8
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
Product
Simple Real Estate Portal System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 6, 2021WP Pro Real Estate 7: Did not properly sanitise the ct_community parameter in its search listing page before outputting it back in itCVE-2021-24387 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Product
WP Pro Real Estate 7
Fixed in
3.1.1
What to do
Update WP Pro Real Estate 7 to 3.1.1 or newer.
Full record and what to do →NVD record contempothemes.com wpscan.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.CVE-2019-20337 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 7.2
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.CVE-2019-20336 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.1
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.CVE-2018-15189 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 5.4
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in theCVE-2018-15188 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.5
PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in the Name field of a profile.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.CVE-2018-15187 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 8
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Feb 22, 2018SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.CVE-2018-7319 · Other software · OS Property Real Estate Project · reported by MITRECritical 9.8
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.
Product
OS Property Real Estate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 7, 2018PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.CVE-2018-6796 · Other software · Multilanguage Real Estate MLM Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.
Product
Multilanguage Real Estate MLM Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 29, 2018SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.CVE-2018-6364 · Other software · Multilanguage Real Estate MLM Script Project · reported by MITRECritical 9.8
SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
Product
Multilanguage Real Estate MLM Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.CVE-2018-5078 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.CVE-2018-5077 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.CVE-2018-5076 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.CVE-2018-5075 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.CVE-2018-5074 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has CSRF via admin/movieedit.php.CVE-2018-5073 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.8
Online Ticket Booking has CSRF via admin/movieedit.php.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.CVE-2018-5072 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 13, 2017Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.CVE-2017-17603 · Other software · Advanced Real Estate Script Project · reported by MITRECritical 9.8
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 31, 2017Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searcCVE-2017-15991 · Other software · Vastal · reported by MITRECritical 9.8
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 23, 2013SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingiCVE-2013-5931 · Other software · Real-estate-php-script · reported by MITREHigh 7.5
SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
Product
Real Estate PHP Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 23, 2013Cross-site scripting (XSS) vulnerability in search_residential.php in Real Estate PHP Script allows remote attackers to inject arbitrary web script or HTML via CVE-2013-5930 · Other software · Real-estate-php-script · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search_residential.php in Real Estate PHP Script allows remote attackers to inject arbitrary web script or HTML via the bos parameter.
Product
Real Estate PHP Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Aug 13, 2012Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via the (1) link_idd paraCVE-2012-4258 · Other software · Myrephp · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via the (1) link_idd parameter to 1_mobile/listings.php or (2) userid parameter to 1_mobile/agentprofile.php.
Product
Myre Real Estate Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org exploit-db.com
Feb 2, 2012SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands viaCVE-2012-0982 · Other software · Vastal · reported by MITREHigh 7.5
SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Dec 14, 2011Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commandsCVE-2011-4823 · Other software · Extensionsforjoomla · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.
Product
COM Vikrealestate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.joomla.org exploit-db.com
Nov 2, 2011SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL cCVE-2010-5013 · Other software · Mckenziecreations · reported by MITREHigh 7.5
SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter.
Product
Virtual Real Estate Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
Sep 15, 2011SQL injection vulnerability in findagent.php in MYRE Real Estate Software allows remote attackers to execute arbitrary SQL commands via the page parameter.CVE-2011-3394 · Other software · Myrephp · reported by MITREHigh 7.5
SQL injection vulnerability in findagent.php in MYRE Real Estate Software allows remote attackers to execute arbitrary SQL commands via the page parameter.
Product
Myre Real Estate Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secpod.org securityreason.com
Sep 15, 2011Multiple cross-site scripting (XSS) vulnerabilities in findagent.php in MYRE Real Estate Software allow remote attackers to inject arbitrary web script or HTML CVE-2011-3393 · Other software · Myrephp · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in findagent.php in MYRE Real Estate Software allow remote attackers to inject arbitrary web script or HTML via the (1) country1, (2) state1, or (3) city1 parameter.
Product
Myre Real Estate Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secpod.org securityreason.com
Apr 7, 2011Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary CVE-2010-4782 · Other software · Softwebsnepal · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) city, (2) state, (3) country, (4) minprice, (5) maxprice, (6) bed, and (7) bath parameters, different vectors than CVE-2006-6807.
Product
Ananda Real Estate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Feb 15, 2011Multiple SQL injection vulnerabilities in Rae Media INC Real Estate Single and Multi Agent System 3.0 allow remote attackers to execute arbitrary SQL commands vCVE-2010-4738 · Other software · Raemedia · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Rae Media INC Real Estate Single and Multi Agent System 3.0 allow remote attackers to execute arbitrary SQL commands via the probe parameter to (1) multi/city.asp in the Multi Agent System and (2) resulttype.asp in the Single Agent System.
Product
Real Estate Single And Multi Agent System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.