Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
464 results · page 4 of 10
Apr 3, 2024Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix wasCVE-2024-31011 · Other software · beescms · reported by MITRECritical 9.8
Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin_template.php.
- Product
- beescms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arCVE-2024-2097 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.
- Product
- MACH SCM Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Mar 26, 2024SCM Software is a client and server application.CVE-2024-0400 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code (RCE) on the SCM Server remotely. Malicious clients can execute any command by using this RCE vulnerability.
- Product
- MACH SCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Mar 13, 2024In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completionCVE-2023-52608 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a transaction which is still pending, the related payload is fetched too. When an SCMI command times out the channel ownership remains with the platform until eventually a late reply is received and, as a consequence, any further transmission attempt remains pending, waiting for the channel to be relinquished by the platform. Once that late reply is received the channel ownership is given back to the agent and any pending request is then allowed to proceed and overwrite the SMT area of the just delivered late reply; then the wait for the reply to the new request starts. It has been observed that the spurious IRQ related to the late reply can be wrongly associated with the freshly enqueued request: when that happens the SCMI stack in-flight lookup procedure is fooled by the fact that the message header now present in the SMT area is related to the new pending transaction, even though the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 2, 2024In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has calleCVE-2023-52515 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 30, 2024Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=indCVE-2024-22569 · Other software · Poscms · reported by MITREMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0.
- Product
- Poscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.cCVE-2024-22938 · Other software · Bosscms · reported by MITREHigh 7.8
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1.CVE-2024-0414 · Other software · DeShang · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.
- Product
- DSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 8, 2024io_uring UAF, Unix SCM garbage collectionCVE-2022-2602 · Other software · The Linux Kernel Organization · reported by security@ubuntu.comMedium 5.3
io_uring UAF, Unix SCM garbage collection
- Product
- linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcve.mitre.org
Oct 28, 2023A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3.CVE-2023-5837 · Other software · AlexanderLivanov · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3. This vulnerability affects unknown code of the file profile.php of the component Cookie Handler. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243802 is the identifier assigned to this vulnerability.
- Product
- FotosCMS2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.CVE-2023-43953 · Other software · Sscms · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.CVE-2023-43952 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.CVE-2023-43951 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.CVE-2023-39156 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
- Product
- Jenkins Bazaar Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 13, 2023A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2023-37785 · Other software · Impresscms · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.CVE-2020-21474 · Other software · Nucleuscms · reported by MITRECritical 9.8
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.
- Product
- Nucleuscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-33829 · Other software · Cloudogu · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
- Product
- SCM Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combitbucket.org
May 8, 2023Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.phpCVE-2020-22334 · Other software · Beescms · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.php.
- Product
- Beescms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCCVE-2023-30404 · Other software · Aigital · reported by MITRECritical 9.8
Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request.
- Product
- Wireless-n Repeater Mini Router Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmandomat.github.iomandomat.github.io
Apr 13, 2023Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.CVE-2022-33288 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 23, 2023Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd.CVE-2023-23295 · Other software · Korenix · reported by MITREHigh 8.8
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
- Product
- Jetwave 2212g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdanube.comcyberdanube.com
Feb 16, 2023SiteServerCMS 7.1.3 sscms has a file read vulnerability.CVE-2022-44299 · Other software · Sscms · reported by MITREMedium 4.9
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023SiteServer CMS 7.1.3 is vulnerable to SQL Injection.CVE-2022-44298 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.CVE-2022-44297 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.CVE-2022-45966 · Other software · Classcms Project · reported by MITRECritical 9.8
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to injecCVE-2021-43657 · Other software · Simple Client Management System Project · reported by MITREMedium 5.4
A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields.
- Product
- Simple Client Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2022egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.CVE-2022-45145 · Other software · Call-cc · reported by MITRECritical 9.8
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
- Product
- Chicken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.call-cc.orgcode.call-cc.org
Nov 28, 2022Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-44937 · Other software · Bosscms · reported by MITREMedium 6.5
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as critical, was found in MonikaBrzica scm.CVE-2022-3998 · Other software · MonikaBrzica · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213699.
- Product
- scm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022A vulnerability, which was classified as critical, has been found in MonikaBrzica scm.CVE-2022-3997 · Other software · MonikaBrzica · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_bazu.php. The manipulation of the argument email/lozinka/ime/id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-213698 is the identifier assigned to this vulnerability.
- Product
- scm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools.CVE-2022-39297 · Other software · melisplatform · reported by GitHubHigh 7.7
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Product
- melis-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTCVE-2022-41250 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins SCM HttpClient Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 21, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP serCVE-2022-41249 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins SCM HttpClient Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 22, 2022Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.aspCVE-2021-37289 · Other software · Planex · reported by MITREHigh 7.2
Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.
- Product
- Mzk-dp150n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket.CVE-2022-34009 · Other software · Fossil-scm · reported by MITREMedium 5.5
Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.
- Product
- Fossil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfossil-scm.orggainsec.com
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31679 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31678 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An issue was discovered in PESCMS-V2.3.3.CVE-2021-31677 · Other software · Pescms · reported by MITREMedium 6.5
An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022A reflected XSS was discovered in PESCMS-V2.3.3.CVE-2021-31676 · Other software · Pescms · reported by MITREMedium 6.1
A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Nucleus CMS v3.71 is affected by a file upload vulnerability.CVE-2021-37770 · Other software · Nucleuscms · reported by MITREHigh 7.2
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.
- Product
- Nucleus CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP.CVE-2022-28621 · Other software · HPE · reported by security-alert@hpe.comHigh 7.5
A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM.
- Product
- Nonstop Distributed Systems Management / Software Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jun 16, 2022Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.CVE-2022-31908 · Other software · Student Registration And FEE Payment System Project · reported by MITREHigh 7.2
Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
- Product
- Student Registration And FEE Payment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.CVE-2022-30898 · Other software · Chshcms · reported by MITREMedium 6.5
A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).CVE-2022-30349 · Other software · Sscms · reported by MITREMedium 6.1
siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.CVE-2022-29689 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.CVE-2022-29688 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.CVE-2022-29687 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.CVE-2022-29686 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.CVE-2022-29685 · Other software · Chshcms · reported by MITREHigh 8.8
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.CVE-2022-29684 · Other software · Chshcms · reported by MITREHigh 7.2
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.
- Product
- Cscms Music Portal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.