Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
200 results · page 4 of 4
Mar 25, 2022Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.CVE-2022-27884 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input paCVE-2022-26573 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings andCVE-2022-27333 · Other software · Idccms · reported by MITREHigh 7.5
idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings and data.
- Product
- Idccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos.CVE-2021-45787 · Other software · Maccms · reported by MITREMedium 5.4
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.CVE-2021-45786 · Other software · Maccms · reported by MITRECritical 9.8
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.CVE-2022-23389 · Other software · Publiccms · reported by MITRECritical 9.8
PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module.CVE-2020-21434 · Other software · Maccms · reported by MITREMedium 5.4
Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges viaCVE-2020-21387 · Other software · Maccms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.CVE-2020-21386 · Other software · Maccms · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2021A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.CVE-2020-20514 · Other software · Maccms · reported by MITREHigh 8.1
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.CVE-2021-40881 · Other software · Publiccms · reported by MITRECritical 9.8
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and uCVE-2020-21082 · Other software · Maccms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.CVE-2020-21081 · Other software · Maccms · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file deletion vulnerability exists within Maccms10.CVE-2020-21363 · Other software · Maccms · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability exists within Maccms10.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' CVE-2020-21362 · Other software · Maccms · reported by MITREMedium 5.4
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrarCVE-2020-21359 · Other software · Maccms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.CVE-2020-21333 · Other software · Publiccms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2021Directory traversal vulnerability in the yccms 3.3 project.CVE-2020-20290 · Other software · Yccms · reported by MITREHigh 7.5
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.
- Product
- Yccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jiguang.xyzblog.jiguang.xyz
Feb 1, 2021Sql injection vulnerability in the yccms 3.3 project.CVE-2020-20289 · Other software · Yccms · reported by MITRECritical 9.8
Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability.
- Product
- Yccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyccms.netblog.jiguang.xyz
Feb 1, 2021Unrestricted file upload vulnerability in the yccms 3.3 project.CVE-2020-20287 · Other software · Yccms · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution.
- Product
- Yccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyccms.netblog.jiguang.xyz
Sep 9, 2019upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management CVE-2019-16192 · Other software · Doccms · reported by MITRECritical 9.8
upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
- Product
- Doccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2019Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, relatedCVE-2018-19465 · Other software · Maccms · reported by MITREMedium 6.1
Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2019Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action.CVE-2019-9829 · Other software · Maccms · reported by MITREHigh 8.8
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2019Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/moduleCVE-2019-8410 · Other software · Maccms · reported by MITREMedium 6.1
Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters.CVE-2019-7721 · Other software · Nconsulting · reported by MITREHigh 7.5
lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters.
- Product
- Nc-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2018An issue was discovered in PublicCMS V4.0.CVE-2018-18927 · Other software · Publiccms · reported by MITREMedium 4.8
An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2018upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file.CVE-2018-18835 · Other software · Doccms · reported by MITRECritical 9.8
upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file.
- Product
- Doccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 23, 2018An issue was discovered in PublicCMS V4.0.180825.CVE-2018-17368 · Other software · Publiccms · reported by MITREMedium 5.3
An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2018The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload.CVE-2017-3189 · Other software · docCMS · reported by cret@cert.orgHigh 8.1
The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle contains. This vulnerability combined with the path traversal vulnerability (CVE-2017-3188) can lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
- Product
- Administration Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jul 24, 2018The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal.CVE-2017-3188 · Other software · docCMS · reported by cret@cert.orgMedium 6.5
The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
- Product
- Administration Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jul 24, 2018The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery.CVE-2017-3187 · Other software · docCMS · reported by cret@cert.orgHigh 8.8
The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
- Product
- Administration Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jun 27, 2018A remote code execution issue was discovered in PublicCMS V4.0.20180210.CVE-2018-12914 · Other software · Publiccms · reported by MITRECritical 9.8
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2018An issue was discovered in PublicCMS V4.0.20180210.CVE-2018-12494 · Other software · Publiccms · reported by MITREMedium 6.5
An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.html?path=../ URI.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2018An issue was discovered in PublicCMS V4.0.20180210.CVE-2018-12493 · Other software · Publiccms · reported by MITREMedium 6.5
An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?path=../ URI.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.CVE-2018-12114 · Other software · Maccms · reported by MITREHigh 8.8
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cncnblogs.com
May 26, 2018An issue was discovered in PublicCMS V4.0.20180210.CVE-2018-11500 · Other software · Publiccms · reported by MITREHigh 8.8
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2017Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.CVE-2017-17733 · Other software · Maccms · reported by MITRECritical 9.8
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2014Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFICVE-2014-8312 · Network & remote access · SAP · reported by MITRELow 3.5
Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
- Product
- Netweaver Abap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comscn.sap.com
Jun 9, 2014SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.CVE-2014-4009 · Network & remote access · SAP · reported by MITREMedium 5
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
- Product
- Computing Center Management System Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscn.sap.comseclists.org
Apr 10, 2014An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.CVE-2013-7362 · Network & remote access · SAP · reported by MITREHigh 7.5
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.
- Product
- Ccms Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comscn.sap.com
Apr 10, 2014Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.CVE-2013-7356 · Network & remote access · SAP · reported by MITREMedium 5
Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.
- Product
- Ccms / Database Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonapsis.comonapsis.com
Aug 25, 2009All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtainCVE-2008-7069 · Other software · Paul Arbogast · reported by MITREHigh 7.5
All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database configuration information, including credentials, via a direct request to accms.dat.
- Product
- Accms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexploit-db.com
Nov 21, 2008Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid parameter to cms/formCVE-2008-5195 · Other software · Sebrac · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid parameter to cms/form/read.php, (2) the uname parameter to cms/index.php, and other unspecified vectors.
- Product
- Sebraccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Oct 9, 2008Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local files via a ..CVE-2008-4526 · Other software · Customcms · reported by MITREHigh 10
Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php, (2) forums.php, (3) admin.php, (4) header.php, (5) pages/story.php and (6) pages/poll.php.
- Product
- Ccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Sep 19, 2008SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary CVE-2008-4156 · Other software · Customcms · reported by MITREMedium 6.8
SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Gaming Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Feb 6, 2008Directory traversal vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to include and execute arbitrary local files vCVE-2008-0602 · Other software · ALL Club CMS · reported by MITREMedium 6.8
Directory traversal vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the class_name parameter.
- Product
- ALL Club CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 6, 2008SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute arbitrary SQL commands via the name paramCVE-2008-0601 · Other software · ALL Club CMS · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
- Product
- ALL Club CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Jan 4, 2008SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in CVE-2007-6658 · Other software · Customcms · reported by MITREHigh 7.5
SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.
- Product
- Ccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Nov 29, 2007Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_patCVE-2007-6179 · Other software · Kinson Chan Charray · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_path parameter to (1) markdown.php and (2) gallery.php in decoder/.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2006PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in CVE-2006-5304 · Other software · Inccms Technology · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
- Product
- Inccms Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comrahim.webd.pl
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.