Updated 11 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,914 results · page 32 of 39

Feb 24, 2018Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request.CVE-2018-6883 · Other software · Piwigo · reported by MITREMedium 4.9
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
Product
Piwigo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pastebin.com
Feb 11, 2018Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element CVE-2018-6506 · Other software · Minibb · reported by MITREMedium 4.8
Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element in the supertitle field.
Product
Minibb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record offensivehacking.wordpress.com offensivehacking.wordpress.com
Feb 3, 2018Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system filesCVE-2017-17108 · Other software · Konakart · reported by MITRECritical 9.8
Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server.
Product
Konakart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jan 21, 2018index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address paraCVE-2018-5962 · Other software · Control-webpanel · reported by MITREMedium 6.1
index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 21, 2018CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.CVE-2018-5961 · Other software · Control-webpanel · reported by MITREMedium 6.1
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.
Product
Webpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 13, 2018The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execCVE-2018-5694 · Other software · Fop2 · reported by MITREHigh 8.8
The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execute arbitrary commands via the command parameter.
Product
Flash Operator Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.CVE-2018-5293 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5292 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.CVE-2018-5291 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5290 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.CVE-2018-5289 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.CVE-2018-5288 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.CVE-2018-5287 · WordPress plugins & themes · reported by MITREHigh 7.5
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 8, 2018The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.CVE-2018-5286 · WordPress plugins & themes · reported by MITREMedium 6.1
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Affected
2.3 to 2.3
What to do
Affects 2.3 to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jan 5, 2018The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveragingCVE-2014-8336 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
Product
Sql Run Query" panel in WP-DBManager (aka Database Manager)
Fixed in
2.7.2
What to do
Update Sql Run Query" panel in WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD record openwall.com vapid.dhs.org
Dec 30, 2017Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demoCVE-2017-14855 · Other software · Redlion · reported by MITREHigh 8.6
Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42.
Product
HMI Panel Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record misteralfa-hack.blogspot.cl misteralfa-hack.blogspot.cl
Dec 30, 2017PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.CVE-2017-12810 · Other software · Stivasoft · reported by MITREMedium 6.1
PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
Product
Phpjabbers Newsletter Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pastebin.com pastebin.com
Dec 27, 2017PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.CVE-2017-17930 · Other software · Ordermanagementscript · reported by MITREHigh 8.8
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
Product
Professional Service Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 27, 2017FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.CVE-2017-17903 · Other software · Fortunescripts · reported by MITREHigh 8.8
FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.
Product
Lynda Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 19, 2017Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and theCVE-2017-17777 · Other software · Paid TO Read Script Project · reported by MITRECritical 9.8
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter.
Product
Paid TO Read Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2017Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.CVE-2017-17696 · Other software · Techno - Portfolio Management Panel Project · reported by MITREMedium 4.3
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2017Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.CVE-2017-17695 · Other software · Techno - Portfolio Management Panel Project · reported by MITREHigh 8.8
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2017Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.CVE-2017-17694 · Other software · Techno - Portfolio Management Panel Project · reported by MITREMedium 5.4
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 15, 2017Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.CVE-2017-17693 · Other software · Techno - Portfolio Management Panel Project · reported by MITREMedium 4.3
Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 11, 2017Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.CVE-2017-17110 · Other software · Techno - Portfolio Management Panel Project · reported by MITRECritical 9.8
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
Product
Techno - Portfolio Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Nov 22, 2017The Touch Panel (TP) driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory double free vulnerability.CVE-2017-8141 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The Touch Panel (TP) driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash or arbitrary code execution.
Product
P10 Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com huawei.com
Nov 13, 2017A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SCVE-2017-16807 · Other software · Getkirby · reported by MITREMedium 5.4
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
Product
Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record getkirby.com packetstormsecurity.com
Oct 29, 2017tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.CVE-2017-15974 · Other software · Datacomponents · reported by MITRECritical 9.8
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
Product
Tpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 27, 2017Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php.CVE-2017-15949 · Other software · Angry-frog · reported by MITREHigh 7.2
Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php.
Product
Xavier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulnerability-lab.com vulnerability-lab.com
Oct 23, 2017The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.CVE-2017-15812 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
Product
Easy Appointments
Fixed in
1.12.0
What to do
Update Easy Appointments to 1.12.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 14, 2017/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" headCVE-2017-15304 · Other software · Airtame · reported by MITRECritical 9.8
/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. This can be used to achieve persistent access to the admin panel even after an admin password change.
Product
Hdmi Dongle Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record utkusen.com utkusen.com
Sep 19, 2017The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks andCVE-2017-14141 · Other software · Kaltura · reported by MITREHigh 7.2
The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
Product
Kaltura Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Sep 19, 2017AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.CVE-2017-14597 · Other software · Afterlogic · reported by MITREMedium 4.8
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.
Product
Aurora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record auroramail.wordpress.com auroramail.wordpress.com
Aug 28, 2017SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2017-10839 · Other software · SEO Panel · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvn.jp
Aug 28, 2017Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-10838 · Other software · SEO Panel · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
SEO Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvn.jp
Aug 23, 2017Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary CVE-2017-12844 · Other software · Icewarp · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record youtu.be youtu.be
Aug 18, 2017Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.CVE-2015-5057 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.
Fixed in
1.10.9
What to do
Update the plugin to 1.10.9 or newer.
Full record and what to do →NVD record openwall.com securityfocus.com
Aug 7, 2017ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on PanelsCVE-2015-7875 · Other software · Chaos Tool Suite Project · reported by MITREHigh 7.5
ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Product
Ctools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jul 26, 2017Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers tCVE-2017-11666 · Other software · Kopano · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a specially crafted previewable file.
Product
Webapp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stash.kopano.io stash.kopano.io
Jul 19, 2017The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66CVE-2017-11441 · Websites & servers · Cpanel · reported by MITREMedium 5.4
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297.
Product
WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record news.cpanel.com news.cpanel.com
Jun 14, 2017A Missing Authorization issue was discovered in Rockwell Automation PanelView Plus 6 700-1500 6.00.04, 6.00.05, 6.00.42, 6.00-20140306, 6.10.20121012, 6.10-2014CVE-2017-7914 · Other software · Rockwellautomation · reported by ics-cert@hq.dhs.govHigh 8.6
A Missing Authorization issue was discovered in Rockwell Automation PanelView Plus 6 700-1500 6.00.04, 6.00.05, 6.00.42, 6.00-20140306, 6.10.20121012, 6.10-20140122, 7.00-20121012, 7.00-20130108, 7.00-20130325, 7.00-20130619, 7.00-20140128, 7.00-20140310, 7.00-20140429, 7.00-20140621, 7.00-20140729, 7.00-20141022, 8.00-20140730, and 8.00-20141023. There is no authorization check when connecting to the device, allowing an attacker remote access.
Product
Panelview Plus 6 700-1500 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Apr 2, 2017Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130, Versions before NEM-UL10C17B160, Versions before NEM-UL10C00B160, VeCVE-2016-8775 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130, Versions before NEM-UL10C17B160, Versions before NEM-UL10C00B160, Versions before NEM-TL00C01B160 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow.
Product
Nem-al10 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com securityfocus.com
Mar 21, 2017A Cross-Site Scripting (XSS) was discovered in GamePanelX-V3 3.0.12.CVE-2017-7205 · Other software · Gamepanelx · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) was discovered in GamePanelX-V3 3.0.12. The vulnerability exists due to insufficient filtration of user-supplied data (a) passed to the "GamePanelX-V3-master/ajax/ajax.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Product
Gamepanelx-v3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Mar 3, 2017Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.CVE-2017-5616 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.CVE-2017-5615 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors inCVE-2017-5614 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.CVE-2017-5613 · Websites & servers · Cpanel · reported by MITREHigh 7.8
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Feb 13, 2017An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis CVE-2016-8374 · Other software · Schneider-electric · reported by ics-cert@hq.dhs.govHigh 7.5
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION.
Product
Magelis GTU Universal Panel Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis CVE-2016-8367 · Other software · Schneider-electric · reported by ics-cert@hq.dhs.govMedium 5.3
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.
Product
Magelis GTU Universal Panel Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Jan 31, 2017Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before CVE-2016-9421 · Other software · Mybb · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Merge System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.