Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,399 results · page 41 of 48
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_iCVE-2022-1349 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
- Product
- Visual Slide Box Builder
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profilCVE-2022-1051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
Apr 20, 2022gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.CVE-2022-29537 · Other software · Gpac · reported by MITREMedium 5.5
gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
- Product
- Elementor Website Builder
- Affected
- 3.6.0 to 3.6.2
- What to do
- Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 14, 2022OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/MCVE-2022-27188 · Other software · Yokogawa Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.8
OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.
- Product
- CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022Visual Form Builder: Is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV fileCVE-2022-0142 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
- Product
- Visual Form Builder
- Fixed in
- 3.0.8
- What to do
- Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 12, 2022Visual Form Builder: Does not enforce nonce checksCVE-2022-0141 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks
- Product
- Visual Form Builder
- Fixed in
- 3.0.8
- What to do
- Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
- Product
- Visual Form Builder
- Fixed in
- 3.0.6
- What to do
- Update Visual Form Builder to 3.0.6 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 11, 2022Nimble Page Builder: Does not sanitise and escape the preview-level-guid parameter before outputting it back in the pageCVE-2022-0314 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Nimble Page Builder
- Fixed in
- 3.2.2
- What to do
- Update Nimble Page Builder to 3.2.2 or newer.
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Profile Builder
- Fixed in
- 3.6.8
- What to do
- Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 4, 2022FormBuilder: Does not have CSRF checks in placeCVE-2022-0830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
- Product
- FormBuilder
- Affected
- up to 1.08
- What to do
- Affects up to 1.08. Update FormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2022Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base SoftCVE-2021-22277 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.5
Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Software for SoftControl allows an attacker to cause the denial of service.
- Product
- 800xA, Control Software for AC 800M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
- Product
- Popup Builder
- Fixed in
- 4.1.1
- What to do
- Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 24, 2022Flask-AppBuilder is an application development framework, built on top of the Flask web framework.CVE-2022-24776 · Other software · dpgaspar · reported by GitHubMedium 6.1
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Pricing Table Builder
- Fixed in
- 1.1.5
- What to do
- Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
- Product
- Page Builder KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24718 · Other software · Finastra · reported by GitHubHigh 7.6
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR).CVE-2022-24717 · Other software · Finastra · reported by GitHubMedium 6.1
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.
- Product
- ssr-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
- Product
- Contact Forms - Drag & Drop Contact Form Builder
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Popup Builder: Does not validate and sanitise the sgpb_type parameter before using it in a require statementCVE-2021-25082 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Custom Popup Builder: Autoload data from its popup on every pagesCVE-2022-0214 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
- Product
- Custom Popup Builder
- Fixed in
- 1.3.1
- What to do
- Update Custom Popup Builder to 1.3.1 or newer.
Feb 14, 2022PowerPack Lite for Beaver Builder: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2022-0176 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- PowerPack Lite for Beaver Builder
- Fixed in
- 1.2.9.3
- What to do
- Update PowerPack Lite for Beaver Builder to 1.2.9.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 9, 2022Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthenticaCVE-2022-21205 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access.
- Product
- Quartus Prime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service.CVE-2021-44206 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Jan 31, 2022Flask-AppBuilder is an application development framework, built on top of the Flask web framework.CVE-2022-21659 · Other software · Dpgaspar · reported by GitHubMedium 5.3
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.
- Product
- Flask-appbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022Landing Page Builder: Was affected by a reflected XSS in page-builder-add on the ulpb_post admin pageCVE-2021-25067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
- Product
- Landing Page Builder
- Fixed in
- 1.4.9.6
- What to do
- Update Landing Page Builder to 1.4.9.6 or newer.
Jan 12, 2022Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path CVE-2022-23118 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.
- Product
- Jenkins Debian Package Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 10, 2022A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly haCVE-2021-36412 · Other software · Gpac · reported by MITREHigh 7.8
A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified other impact via a crafted file in the MP4Box command,
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46055 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).CVE-2021-46054 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.CVE-2021-46048 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.CVE-2021-42748 · Other software · Fastlinemedia · reported by MITREMedium 5.3
In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.
- Product
- Beaver Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wpbeaverbuilder.comtekfused.com
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.6.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Dec 21, 2021A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.CVE-2021-45293 · Other software · Webassembly · reported by MITREMedium 5.5
A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Contact Form, Drag and Drop Form Builder for
- Fixed in
- 1.8.0
- What to do
- Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Dec 15, 2021SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.CVE-2021-44350 · Other software · Thinkphp · reported by MITRECritical 9.8
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 9, 2021Flask-AppBuilder is a development framework built on top of Flask.CVE-2021-41265 · Other software · dpgaspar · reported by GitHubHigh 8.1
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Elementor Website Builder: Does not sanitise or escape user input appended to the DOM via a malicious hashCVE-2021-24891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
- Product
- Elementor Website Builder
- Fixed in
- 3.4.8
- What to do
- Update Elementor Website Builder to 3.4.8 or newer.
Full record and what to do →NVD recordwpscan.comjbelamor.com
Nov 10, 2021The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exCVE-2021-33816 · Other software · Dolibarr · reported by MITRECritical 9.8
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgtrovent.github.io
Nov 8, 2021MAZ Loader – Preloader Builder for: Does not validate or escape the loader_id parameter of the mzldr shortcodeCVE-2021-24669 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.
- Product
- MAZ Loader – Preloader Builder for
- Fixed in
- 1.3.3
- What to do
- Update MAZ Loader – Preloader Builder for to 1.3.3 or newer.
Oct 29, 2021On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not CVE-2021-22038 · Other software · VMware · reported by security@vmware.comHigh 8.8
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.
- Product
- Installbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.installbuilder.comblog.installbuilder.com
Oct 29, 2021Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command.CVE-2021-22037 · Other software · VMware · reported by security@vmware.comHigh 7.8
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
- Product
- Installbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.installbuilder.comblog.installbuilder.com
Oct 25, 2021Formidable Form Builder: Allows to inject certain HTML Tags like <audio>CVE-2021-24884 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.
- Product
- Formidable Form Builder
- Fixed in
- 4.09.05
- What to do
- Update Formidable Form Builder to 4.09.05 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.