Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
226 results · page 4 of 5
Mar 30, 2023Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1761 · Other software · thorsten · reported by security@huntr.devMedium 6.3
Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1760 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1759 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1755 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1754 · Other software · thorsten · reported by security@huntr.devMedium 4.7
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1753 · Other software · thorsten · reported by security@huntr.devMedium 5.5
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0880 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0794 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0793 · Other software · thorsten · reported by security@huntr.devHigh 7.1
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0792 · Other software · thorsten · reported by security@huntr.devMedium 6.5
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0791 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0790 · Other software · thorsten · reported by security@huntr.devHigh 7.6
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0789 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0788 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0787 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0786 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0314 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0313 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0312 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0311 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0310 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0309 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0308 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0307 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0306 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4409 · Other software · thorsten · reported by security@huntr.devHigh 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4408 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4407 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3766 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3765 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2022Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3754 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.CVE-2022-3608 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.CVE-2018-16651 · Websites & servers · Phpmyfaq · reported by MITREHigh 7.2
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyfaq.dephpmyfaq.de
Sep 7, 2018phpMyFAQ before 2.9.11 allows CSRF.CVE-2018-16650 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
phpMyFAQ before 2.9.11 allows CSRF.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpmyfaq.dephpmyfaq.de
Aug 28, 2018phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.CVE-2014-6050 · Websites & servers · Phpmyfaq · reported by MITREMedium 5.3
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Aug 28, 2018phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.CVE-2014-6049 · Websites & servers · Phpmyfaq · reported by MITRELow 2.7
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Aug 28, 2018phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.CVE-2014-6048 · Websites & servers · Phpmyfaq · reported by MITREMedium 5.3
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Aug 28, 2018phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment"CVE-2014-6047 · Websites & servers · Phpmyfaq · reported by MITREMedium 5.3
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Aug 28, 2018Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users foCVE-2014-6046 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Aug 28, 2018SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors iCVE-2014-6045 · Websites & servers · Phpmyfaq · reported by MITREHigh 7.2
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdefencelabs.comphpmyfaq.de
Oct 23, 2017In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.CVE-2017-15809 · Websites & servers · Phpmyfaq · reported by MITREMedium 6.1
In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2017In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.CVE-2017-15808 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.CVE-2017-15735 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.CVE-2017-15734 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.CVE-2017-15733 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.CVE-2017-15732 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.CVE-2017-15731 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.CVE-2017-15730 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.CVE-2017-15729 · Websites & servers · Phpmyfaq · reported by MITREHigh 8.8
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2017In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.CVE-2017-15728 · Websites & servers · Phpmyfaq · reported by MITREMedium 4.8
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
- Product
- Phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.