Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
350 results · page 4 of 7
Nov 20, 2023An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.CVE-2023-47311 · Other software · Spaceapplications · reported by MITREMedium 6.1
An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 20, 2023Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptCCVE-2023-46471 · Other software · Spaceapplications · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 20, 2023Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in thCVE-2023-46470 · Other software · Spaceapplications · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Oct 25, 2023An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.CVE-2023-46010 · Other software · Seacms · reported by MITRECritical 9.8
An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Oct 9, 2023An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.CVE-2023-44848 · Other software · Seacms · reported by MITREHigh 8.1
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Oct 9, 2023An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component.CVE-2023-44847 · Other software · Seacms · reported by MITREHigh 7.2
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Oct 9, 2023An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.CVE-2023-44846 · Other software · Seacms · reported by MITREHigh 8.8
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Sep 27, 2023SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.CVE-2023-44172 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.CVE-2023-44171 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.CVE-2023-44170 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.CVE-2023-44169 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.CVE-2023-43222 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Sep 27, 2023SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.CVE-2023-43216 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.CVE-2023-43278 · Other software · Seacms · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netseacms.net
Sep 5, 2023Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php.CVE-2023-39681 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMSCVE-2020-20523 · Other software · Gilacms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTMCVE-2023-37125 · Other software · Seacms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a craftCVE-2023-37124 · Other software · Seacms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.CVE-2023-3445 · Other software · spinacms · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
- Product
- spinacms/spina
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.CVE-2020-20726 · Other software · Gilacms · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability was found in SeaCMS 11.6 and classified as problematic.CVE-2023-2926 · Other software · Seacms · reported by VulDBMedium 5.4
A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Picture Upload Handler. The manipulation of the argument oldpic leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230081 was assigned to this vulnerability.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title parameter.CVE-2023-27090 · Other software · Teacms Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title parameter.
- Product
- Teacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).CVE-2023-27091 · Other software · Teacms Project · reported by MITREHigh 7.2
An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).
- Product
- Teacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2.CVE-2023-1616 · Other software · XiaoBingBy · reported by VulDBLow 3.5
A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2. It has been classified as problematic. Affected is an unknown function of the component Article Title Handler. The manipulation with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223800.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical.CVE-2023-1483 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0.CVE-2023-1398 · Other software · XiaoBingBy · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023A vulnerability was found in SeaCMS 11.6 and classified as problematic.CVE-2023-0960 · Other software · Seacms · reported by VulDBMedium 4.7
A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnote.youdao.com
Feb 15, 2023Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via indCVE-2021-33396 · Other software · Baijiacms Project · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Tinacms is a Git-backed headless content management system with support for visual editing.CVE-2023-25164 · Other software · tinacms · reported by GitHubHigh 8.6
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.CVE-2022-48093 · Other software · Seacms · reported by MITREHigh 7.2
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.CVE-2022-47002 · Other software · Masacms · reported by MITRECritical 9.8
A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
- Product
- Masacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhoyahaxa.com
Jan 27, 2023AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.CVE-2022-48116 · Other software · Ayacms Project · reported by MITREHigh 7.2
AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrarCVE-2021-29368 · Other software · Cuppacms · reported by MITREHigh 8.8
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.phpCVE-2022-47926 · Other software · Ayacms Project · reported by MITRECritical 9.8
AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.phpCVE-2022-46102 · Other software · Ayacms Project · reported by MITRECritical 9.8
AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code.CVE-2022-46101 · Other software · Ayacms Project · reported by MITREHigh 8.8
AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code.
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.CVE-2022-45942 · Other software · Baijiacms Project · reported by MITREHigh 8.8
A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthis-is-y.xyz
Dec 15, 2022An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the actioCVE-2021-39426 · Other software · Seacms · reported by MITRECritical 9.8
An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).CVE-2022-45550 · Other software · Ayacms Project · reported by MITRECritical 9.8
AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.CVE-2022-45548 · Other software · Ayacms Project · reported by MITREHigh 8.8
AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php.CVE-2022-43256 · Other software · Seacms · reported by MITRECritical 9.8
SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php.CVE-2022-43074 · Other software · Ayacms Project · reported by MITRECritical 9.8
AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Ayacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary CVE-2022-38931 · Other software · Baijiacms Project · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI.CVE-2022-37191 · Other software · Cuppacms · reported by MITREMedium 6.5
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE).CVE-2022-37190 · Other software · Cuppacms · reported by MITREHigh 8.8
CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.CVE-2022-38296 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups.CVE-2022-38295 · Other software · Cuppacms · reported by MITREMedium 6.1
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.CVE-2022-35150 · Other software · Baijiacms Project · reported by MITRECritical 9.8
Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.CVE-2022-35147 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.CVE-2022-34121 · Other software · Cuppacms · reported by MITREHigh 7.5
Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.