Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
262 results · page 3 of 6
Feb 20, 2024MeshCentral is a full computer management web site.CVE-2024-26135 · Other software · Ylianst · reported by GitHubHigh 8.3
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.
- Product
- MeshCentral
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php.CVE-2024-24469 · Other software · flushcms · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php.
- Product
- flushcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.CVE-2023-51838 · Other software · Meshcentral · reported by MITREHigh 7.5
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
- Product
- Meshcentral
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.CVE-2023-51837 · Other software · Meshcentral · reported by MITRECritical 9.8
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
- Product
- Meshcentral
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.CVE-2023-51842 · Other software · Meshcentral · reported by MITREHigh 7.5
An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
- Product
- Meshcentral
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.CVE-2023-42541 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
- Product
- Samsung Push Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.CVE-2023-46551 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
- Product
- x2000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability, which was classified as critical, was found in mccms 2.6.CVE-2023-5029 · Other software · Chshcms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239871.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h.CVE-2023-3745 · Other software · Red Hat · reported by Red HatMedium 5.5
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 27, 2023Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.phCVE-2020-18409 · Other software · Catfishcms Project · reported by MITREMedium 6.8
Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
- Product
- Catfishcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.CVE-2020-20969 · Other software · Pluck-cms · reported by MITREHigh 7.2
File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.
- Product
- Pluck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability classified as critical has been found in mccms up to 2.6.5.CVE-2023-3236 · Other software · Chshcms · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in mccms up to 2.6.5.CVE-2023-3235 · Other software · Chshcms · reported by VulDBMedium 6.3
A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231506 is the identifier assigned to this vulnerability.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache ConfiguraCVE-2023-26782 · Other software · Chshcms · reported by MITREMedium 6.5
An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-26781 · Other software · Chshcms · reported by MITRECritical 9.8
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-29815 · Other software · Chshcms · reported by MITREHigh 8.8
mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in theCVE-2023-21088 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-235823542
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 22, 2022The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a usCVE-2022-45409 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 9, 2022A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.CVE-2022-30898 · Other software · Chshcms · reported by MITREMedium 6.5
A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.CVE-2022-29689 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.CVE-2022-29688 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.CVE-2022-29687 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.CVE-2022-29686 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.CVE-2022-29685 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.CVE-2022-29684 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.CVE-2022-29683 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.CVE-2022-29682 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.CVE-2022-29681 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.CVE-2022-29680 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.CVE-2022-29676 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.CVE-2022-29670 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.CVE-2022-29669 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy.CVE-2022-29667 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.CVE-2022-29666 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.CVE-2022-29665 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.CVE-2022-29664 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.CVE-2022-29663 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.CVE-2022-29662 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.CVE-2022-29661 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.CVE-2022-29660 · Other software · Chshcms · reported by MITRECritical 9.8
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Cscms 4.1 is vulnerable to SQL Injection.CVE-2022-28552 · Other software · Chshcms · reported by MITREHigh 8.8
Cscms 4.1 is vulnerable to SQL Injection. Log into the background, open the song module, create a new song, delete it to the recycle bin, and SQL injection security problems will occur when emptying the recycle bin.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.CVE-2022-27369 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan.CVE-2022-27368 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del.CVE-2022-27367 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy.CVE-2022-27366 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.CVE-2022-27365 · Other software · Chshcms · reported by MITREHigh 7.2
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.CVE-2022-27090 · Other software · Chshcms · reported by MITREMedium 5.4
Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invokiCVE-2022-26081 · Other software · KINGSOFT JAPAN, INC. · reported by vultures@jpcert.or.jpHigh 7.8
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
- Product
- The installer of WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.kingsoft.jp
Feb 18, 2022An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3.CVE-2022-24979 · Other software · Mittwald · reported by MITREMedium 5.3
An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.
- Product
- Varnishcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2022cscms v4.1 allows for SQL injection via the "page_del" function.CVE-2020-28103 · Other software · Chshcms · reported by MITRECritical 9.8
cscms v4.1 allows for SQL injection via the "page_del" function.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.