Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 42 of 73
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).CVE-2021-37457 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Wireless).CVE-2021-2362 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Wireless). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it improperly validates the length field in a request from a guestCVE-2021-1097 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it improperly validates the length field in a request from a guest. This flaw allows a malicious guest to send a length field that is inconsistent with the actual length of the input, which may lead to information disclosure, data tampering, or denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).
- Product
- NVIDIA Virtual GPU Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 14, 2021Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials thCVE-2021-35527 · Other software · Hitachi ABB Power Grids · reported by cybersecurity@hitachienergy.comHigh 7.5
Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials that are stored by the browser. This issue affects: Hitachi ABB Power Grids eSOMS version 6.3 and prior versions.
- Product
- eSOMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 12, 2021Sign-up Sheets: Did not sanitise or escape some of its fieldsCVE-2021-24440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard
- Product
- Sign-up Sheets
- Fixed in
- 1.0.14
- What to do
- Update Sign-up Sheets to 1.0.14 or newer.
Jul 12, 2021Salon booking system: Does not properly sanitise and escape the First Name fieldCVE-2021-24429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 6.3.1
- What to do
- Update Salon booking system to 6.3.1 or newer.
Jul 12, 2021Request a Quote: Did not sanitise and escape some of its quote fieldsCVE-2021-24420 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
- Product
- Request a Quote
- Fixed in
- 2.3.4
- What to do
- Update Request a Quote to 2.3.4 or newer.
Jul 7, 2021Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.CVE-2020-25925 · Other software · Icewarp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashketchum.medium.comashketchum.medium.com
Jul 7, 2021Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.CVE-2020-24147 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
- Product
- WP Smart Import (wp-smart-import)
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update WP Smart Import (wp-smart-import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Jul 6, 2021HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CECVE-2021-22232 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.CVE-2020-22251 · Websites & servers · Phplist · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021WP Offload SES Lite: Did not escape some of the fields in the Activity page of the admin dashboardCVE-2021-24494 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
- Product
- WP Offload SES Lite
- Fixed in
- 1.4.5
- What to do
- Update WP Offload SES Lite to 1.4.5 or newer.
Jul 6, 2021In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the userCVE-2021-24388 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.7
- What to do
- Update VikRentCar Car Rental Management System to 1.1.7 or newer.
Jul 1, 2021Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.CVE-2020-23219 · Other software · Monstra · reported by MITREHigh 8.8
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
- Product
- Monstra CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses.CVE-2021-35525 · Other software · Postsrsd Project · reported by MITREMedium 5.3
PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."
- Product
- Postsrsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orggithub.com
Jun 28, 2021main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.CVE-2021-34187 · Other software · Chamilo · reported by MITRECritical 9.8
main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2021app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.CVE-2021-35502 · Other software · Misp-project · reported by MITRECritical 9.8
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2021PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console.CVE-2021-35501 · Other software · Pandorafms · reported by MITREMedium 5.4
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comk4m1ll0.com
Jun 25, 2021SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server.CVE-2021-35475 · Other software · SAS · reported by MITREMedium 5.4
SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.
- Product
- Environment Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,CVE-2020-19511 · Other software · Typesettercms · reported by MITREMedium 6.1
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
- Product
- Typesetter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.topsec.com.cnblog.topsec.com.cn
Jun 21, 2021Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function.CVE-2020-22390 · Other software · Akaunting · reported by MITREHigh 8.8
Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.
- Product
- Akaunting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2021An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2.CVE-2021-33557 · Other software · Mantisbt · reported by MITREMedium 6.1
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
- Product
- Mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmantisbt.orgmantisbt.org
Jun 16, 2021Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.CVE-2021-32244 · Other software · Moodle · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitisedCVE-2021-24357 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
- Product
- Best Image Gallery & Responsive Photo Gallery – FooGallery
- Fixed in
- 2.0.35
- What to do
- Update Best Image Gallery & Responsive Photo Gallery – FooGallery to 2.0.35 or newer.
Jun 14, 2021theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Did not properly sanitise some of its fieldsCVE-2021-24351 · WordPress plugins & themes · reported by WPScanMedium 6.1
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
- Product
- theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.12
- What to do
- Update theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder to 4.1.12 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 9, 2021Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NANCVE-2020-11134 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame are not Properly validated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 8, 2021In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.CVE-2020-26138 · Other software · Silverstripe · reported by MITREMedium 5.3
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Jun 7, 2021Easy Preloader: Does not sanitise its setting fieldsCVE-2021-24344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
- Product
- Easy Preloader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easy Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
- Product
- WP Statistics
- Fixed in
- 13.0.8
- What to do
- Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 2, 2021Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.CVE-2020-24870 · Other software · Libraw · reported by MITREHigh 8.8
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
- Product
- Libraw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021Bello - Directory & Listing: Did not sanitise the bt_bb_listing_field_price_range_toCVE-2021-24321 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues
- Product
- Bello - Directory & Listing
- Fixed in
- 1.6.0
- What to do
- Update Bello - Directory & Listing to 1.6.0 or newer.
May 28, 2021Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavCVE-2021-32539 · Other software · Hundred Plus · reported by twcert@cert.org.twMedium 5.4
Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack.
- Product
- 101EIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 27, 2021A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other CVE-2020-22022 · Other software · Ffmpeg · reported by MITREHigh 8.8
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtrac.ffmpeg.org
May 26, 2021Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a DeniaCVE-2020-22020 · Other software · Ffmpeg · reported by MITREMedium 6.5
Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.videolan.orglists.debian.org
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
- Fixed in
- 4.21.1
- What to do
- Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
- Product
- Hana Flv Player
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2021Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.CVE-2021-27956 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.comraxis.com
May 17, 2021XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name fieldCVE-2020-29205 · Other software · Projectworlds · reported by MITREMedium 6.1
XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field
- Product
- Travel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnikhilkumar01.medium.com
May 17, 2021SEO Redirection Plugin – 301 Redirect Manager: Did not sanitise the Redirect From and Redirect To fieldsCVE-2021-24327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
- Product
- SEO Redirection Plugin – 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update SEO Redirection Plugin – 301 Redirect Manager to 6.4 or newer.
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
- Fixed in
- 5.2.0
- What to do
- Update the plugin to 5.2.0 or newer.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 17, 2021Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, alloCVE-2021-29046 · Other software · Liferay · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
May 14, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of cCVE-2020-18167 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".
- Product
- Laobancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used.CVE-2021-22137 · Other software · Elastic · reported by security@elastic.coMedium 5.3
In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
May 12, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on thCVE-2020-18165 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
- Product
- Laobancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options.CVE-2021-32573 · Other software · Express-cart Project · reported by MITREMedium 4.8
The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website.
- Product
- Express-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 11, 2021Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScripCVE-2021-32544 · Other software · Intelligent global technology Ltd · reported by twcert@cert.org.twMedium 5.4
Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks.
- Product
- igt+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 11, 2021RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated aCVE-2021-30174 · Other software · RiyaLab Co., Ltd. · reported by twcert@cert.org.twMedium 5.4
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
- Product
- CloudISO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.