Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,672 results · page 40 of 54

Nov 21, 2022A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2022-43143 · Other software · Beekeeperstudio · reported by MITRECritical 9.6
A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error modal container.
Product
Beekeeper-studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 17, 2022A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2022-43332 · Other software · Wondercms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel.
Product
Wondercms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 14, 2022A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2022-44390 · Other software · Eyoucms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
Product
Eyoucms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2022Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422.CVE-2022-45129 · Other software · Payara · reported by MITREHigh 7.5
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
Product
Payara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 9, 2022A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2022-43119 · Other software · Csphere · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username parameter.
Product
Clansphere
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2022A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2022-43118 · Other software · Flatcore · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
Product
Flatcore-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 8, 2022A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.CVE-2022-43144 · Other software · Canteen Management System Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Product
Canteen Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Oct 19, 2022A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloCVE-2022-41358 · Other software · Garage Management System Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php.
Product
Garage Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cxsecurity.com
Oct 17, 2022Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.CVE-2022-42143 · Other software · Open Source Sacco Management System Project · reported by MITREHigh 7.2
Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.
Product
Open Source Sacco Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 13, 2022A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected CVE-2022-35612 · Other software · Bevywise · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
Product
Mqttroute
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityblog101.blogspot.com securityblog101.blogspot.com
Oct 7, 2022A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2022-41392 · Other software · Totaljs · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
Product
Total.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com edoardoottavianelli.it
Oct 6, 2022A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the CVE-2022-39988 · Other software · Centreon · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the Service>Templates service_alias parameter.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 29, 2022FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page mCVE-2022-40408 · Other software · Feehi · reported by MITREMedium 5.4
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
Product
Feehicms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 27, 2022ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will CVE-2022-37028 · Other software · Iris · reported by MITREMedium 5.4
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application.
Product
Isams
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cds.thalesgroup.com excellium-services.com
Sep 23, 2022Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_payment.php.CVE-2022-40092 · Other software · Online Tours And Travels Management System Project · reported by MITREHigh 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_payment.php.
Product
Online Tours And Travels Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 20, 2022The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encCVE-2022-39956 · Other software · OWASP · reported by vulnerability@ncsc.chHigh 7.3
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).
Product
ModSecurity Core Rule Set
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coreruleset.org lists.debian.org
Sep 16, 2022CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executCVE-2022-38844 · Other software · Espocrm · reported by MITREHigh 8
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
Product
Espocrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Sep 16, 2022Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in SnapdragonCVE-2022-25656 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Sep 14, 2022PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE).CVE-2022-37140 · Other software · Techvill · reported by MITREHigh 8
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file.
Product
Paymoney
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com paymoney.techvill.org
Sep 14, 2022PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket.CVE-2022-37137 · Other software · Techvill · reported by MITREMedium 5.4
PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function.
Product
Paymoney
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com paymoney.techvill.org
Sep 13, 2022A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.CVE-2022-1278 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Product
Wildfly
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Sep 9, 2022A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intCVE-2022-38639 · Other software · Inkdrop · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.
Product
Markdown Nice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2022Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.CVE-2022-36876 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 1.8
Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.
Product
Samsung Pass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files CVE-2022-36872 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
Product
Samsung Pay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files wCVE-2022-36871 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
Product
Samsung Pay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to aCVE-2022-36870 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
Product
Samsung Pay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
Product
Simple Payment Donations & Subscriptions
Fixed in
4.2.1
What to do
Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 1, 2022In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster rCVE-2022-1677 · Other software · Redhat · reported by Red HatMedium 6.3
In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.
Product
Openshift Container Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Aug 29, 2022Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameteCVE-2022-36194 · Other software · Centreon · reported by MITREMedium 5.4
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 28, 2022A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2022-36573 · Other software · Pagekit · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.
Product
Pagekit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 26, 2022Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_payment.CVE-2022-36683 · Other software · Simple Task Scheduling System Project · reported by MITRECritical 9.8
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_payment.
Product
Simple Task Scheduling System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 25, 2022Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blogCVE-2022-36527 · Other software · Jflyfox · reported by MITREMedium 5.4
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
Product
Jfinal CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 18, 2022Payara through 5.2022.2 allows directory traversal without authentication.CVE-2022-37422 · Other software · Payara · reported by MITREHigh 7.5
Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.
Product
Payara
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.payara.fish payara.fish
Aug 18, 2022A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-35174 · Other software · Getkirby · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
Product
Starterkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record owasp.org youtube.com
Aug 17, 2022A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2022-35133 · Other software · Cherrytree Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.
Product
Cherrytree
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com drive.google.com
Aug 4, 2022An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.CVE-2022-35142 · Other software · Raneto Project · reported by MITREHigh 7.5
An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
Product
Raneto
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raneto.com cwe.mitre.org
Aug 4, 2022In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured onCVE-2022-34655 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Aug 2, 2022A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intoCVE-2022-34619 · Other software · Mealie Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field.
Product
Mealie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwe.mitre.org docs.mealie.io
Aug 2, 2022A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected CVE-2022-34618 · Other software · Mealie Project · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field.
Product
Mealie
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwe.mitre.org docs.mealie.io
Aug 2, 2022The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.CVE-2022-25867 · Other software · Socket · reported by report@snyk.ioHigh 7.5
The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
Product
Socket.io-client Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2022Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services.CVE-2022-35917 · Other software · solana-labs · reported by GitHubMedium 5.3
Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied `validateTransfer` function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers. This issue has been patched as of version `0.2.1`. Users of the Solana Pay SDK should upgrade to it. There are no known workarounds for this issue.
Product
solana-pay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 27, 2022Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket.CVE-2022-34009 · Other software · Fossil-scm · reported by MITREMedium 5.5
Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.
Product
Fossil
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fossil-scm.org gainsec.com
Jul 26, 2022Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.CVE-2022-34991 · Other software · Techvill · reported by MITREMedium 5.4
Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.
Product
Paymoney
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 25, 2022Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.CVE-2022-35131 · Other software · Joplinapp · reported by MITRECritical 9
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Product
Joplin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 22, 2022The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.CVE-2022-25759 · Other software · Convert-svg-core Project · reported by report@snyk.ioCritical 9.9
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
Product
Convert-svg-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 22, 2022Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-33901 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 17, 2022Accept Stripe Payments: Does not sanitize and escape some of its settingsCVE-2022-2194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Accept Stripe Payments
Fixed in
2.0.64
What to do
Update Accept Stripe Payments to 2.0.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titlesCVE-2022-2099 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Product
WooCommerce
Fixed in
6.6.0
What to do
Update WooCommerce to 6.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 15, 2022In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-29890 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.1
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jul 12, 2022Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server dueCVE-2021-36667 · Other software · Druva · reported by MITREHigh 7.8
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.
Product
Insync Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.druva.com imhotepisinvisible.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.