Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
402 results · page 4 of 9
Dec 22, 2025SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously craftedCVE-2023-53966 · Other software · SOUND4 Ltd. · reported by VulnCheckCritical 9.3
SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.
- Product
- SOUND4 LinkAndShare Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Dec 16, 2025Dokan Pro: Unauthorized access of dataCVE-2025-12809 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates.
- Product
- Dokan Pro
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65782 · Other software · Wekan Project · reported by MITREMedium 6.5
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65781 · Other software · Wekan Project · reported by MITREHigh 8.2
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65780 · Other software · Wekan Project · reported by MITREHigh 8.8
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65779 · Other software · Wekan Project · reported by MITREHigh 7.5
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65778 · Other software · Wekan Project · reported by MITREHigh 8.1
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart: Privilege escalationCVE-2025-12963 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
- Product
- LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart
- Affected
- up to 1.2.29
- What to do
- Affects up to 1.2.29. Update LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 5, 2025Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.CVE-2025-66557 · Other software · nextcloud · reported by GitHubMedium 5.4
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.CVE-2025-66548 · Other software · nextcloud · reported by GitHubLow 3.3
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of theCVE-2025-55174 · Other software · KDE · reported by MITRELow 3.2
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly.
- Product
- Skanpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominvent.kde.org
Nov 15, 2025Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager: Time-based SQL InjectionCVE-2025-8994 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager
- Affected
- up to 2.6.26
- What to do
- Affects up to 2.6.26. Update Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2025A flaw has been found in DinukaNavaratna Dee Store 1.0.CVE-2025-13063 · Other software · DinukaNavaratna · reported by VulDBMedium 5.5
A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack may be performed from remote. The exploit has been published and may be used. Multiple endpoints are affected.
- Product
- Dee Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities.CVE-2025-61119 · Other software · reported by MITREHigh 7.5
Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-64100 · Other software · ckan · reported by GitHubMedium 6.1
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-54384 · Other software · ckan · reported by GitHubMedium 6.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2025NikanWP WooCommerce Reporting: Cross-Site Request Forgery (CSRF)CVE-2025-62957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS.This issue affects NikanWP WooCommerce Reporting: from n/a through <= 1.0.0.
- Product
- NikanWP WooCommerce Reporting
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update NikanWP WooCommerce Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Dokan: Incorrect Privilege AssignmentCVE-2025-53425 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.
- Product
- Dokan
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with CVE-2025-11020 · Other software · MarkAny · reported by 09832df1-09c1-45b4-8a85-16c601d30febHigh 8.7
An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.
- Product
- SafePC Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Kanpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through <= 1.1.
- Product
- Kanpress
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Kanpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2025Dokan Pro: Privilege escalationCVE-2025-5931 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for authenticated attackers, with vendor-level access and above, to elevate their privilege to the level of a staff member and then change arbitrary user passwords, including those of administrators in order to gain access to their accounts. By default, the plugin allows customers to become vendors.
- Product
- Dokan Pro
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55737 · Other software · DogukanUrker · reported by GitHubMedium 6.9
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55736 · Other software · DogukanUrker · reported by GitHubCritical 9.3
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55735 · Other software · DogukanUrker · reported by GitHubMedium 5.3
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55734 · Other software · DogukanUrker · reported by GitHubMedium 6.9
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.CVE-2025-7961 · Other software · Wulkano · reported by help@fluidattacks.comMedium 6.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.
- Product
- KAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwulkano.comfluidattacks.com
Aug 14, 2025flaskBlog is a blog app built with Flask.CVE-2025-53631 · Other software · DogukanUrker · reported by GitHubMedium 5.3
flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the post. At time of publication, there are no public patches available.
- Product
- flaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-55011 · Other software · kanboard · reported by GitHubMedium 6.4
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor could write a file anywhere on the system the app user controls. The impact is limited due to the filename being hashed and having no extension. This issue has been patched in version 1.2.47.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-55010 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management.CVE-2025-53818 · Other software · Sunwood-ai-labs · reported by GitHubHigh 8.9
GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available.
- Product
- github-kanban-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-52576 · Other software · kanboard · reported by GitHubMedium 5.3
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-52560 · Other software · kanboard · reported by GitHubHigh 8.1
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b.CVE-2025-4838 · Other software · kanwangzjm · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function doPost of the file /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java of the component Login. The manipulation of the argument ret leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Funiture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-46825 · Other software · kanboard · reported by GitHubLow 1.3
Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Programs/P73_SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm.CVE-2025-46833 · Other software · ShashikantSingh09 · reported by GitHubMedium 4.6
Programs/P73_SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker may be able to decrypt the data using brute force attacks and because of this the whole application can be impacted. This issue has been patched in commit 6ce60b1. A workaround involves increasing the key size, for RSA or DSA this is at least 2048 bits, for ECC this is at least 256 bits.
- Product
- python-progrrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45608 · Other software · Zykzhangyukang · reported by MITREHigh 7.5
Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- Xinguan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.CVE-2025-28104 · Other software · Dogukanurker · reported by MITRECritical 9.1
Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.CVE-2025-28103 · Other software · Dogukanurker · reported by MITREMedium 6.4
Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2025-28102 · Other software · Dogukanurker · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 17, 2025An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other usersCVE-2025-28101 · Other software · Dogukanurker · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other users via supplying a crafted POST request.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 9, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Stored Cross-Site ScriptingCVE-2025-3100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.22
- What to do
- Affects up to 2.6.22. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 27, 2025wpShopGermany IT-RECHT KANZLEI: Cross-Site Request Forgery (CSRF)CVE-2025-30804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forgery.This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through <= 2.0.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update wpShopGermany IT-RECHT KANZLEI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems.CVE-2025-30205 · Other software · oddlama · reported by GitHubHigh 7.6
kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag `v1.2.0` or higher. As a workaround, the user can set the log level `KANIDM_LOG_LEVEL` to any level higher than `info`, for example `warn`.
- Product
- kanidm-provision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Time-based SQL InjectionCVE-2024-13500 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.17
- What to do
- Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Unauthorized loss of dataCVE-2024-13752 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.17
- What to do
- Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2025SFTPGo is an open source, event-driven file transfer solution.CVE-2025-24366 · Other software · drakkan · reported by GitHubHigh 7.5
SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- sftpgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path paCVE-2024-57609 · Other software · reported by MITREHigh 8.6
An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-24372 · Other software · ckan · reported by GitHubHigh 7.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none`
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.ckan.orgdocs.ckan.org
Jan 27, 2025An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a craftCVE-2024-56954 · Other software · reported by MITREMedium 6.5
An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2024-57621 · Other software · Monetdb · reported by MITREHigh 7.5
An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Monetdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.