Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
397 results · page 5 of 8
Apr 5, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1758 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1757 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1756 · Other software · thorsten · reported by security@huntr.devMedium 4.7
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxCVE-2023-26858 · Other software · Myprestamodules · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component.
- Product
- Frequently Asked Questions Page
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 30, 2023Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1762 · Other software · thorsten · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1761 · Other software · thorsten · reported by security@huntr.devMedium 6.3
Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1760 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1759 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1755 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1754 · Other software · thorsten · reported by security@huntr.devMedium 4.7
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1753 · Other software · thorsten · reported by security@huntr.devMedium 5.5
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPB Advanced FAQ
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.CVE-2023-22678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 16, 2023Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0880 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0794 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0793 · Other software · thorsten · reported by security@huntr.devHigh 7.1
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0792 · Other software · thorsten · reported by security@huntr.devMedium 6.5
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0791 · Other software · thorsten · reported by security@huntr.devHigh 8.3
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0790 · Other software · thorsten · reported by security@huntr.devHigh 7.6
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0789 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0788 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0787 · Other software · thorsten · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-0786 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0314 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0313 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0312 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0311 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0310 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0309 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0308 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0307 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.CVE-2023-0306 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4409 · Other software · thorsten · reported by security@huntr.devHigh 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4408 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.CVE-2022-4407 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3766 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3765 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2022Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-3754 · Other software · thorsten · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email)CVE-2022-38104 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
- Product
- Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 19, 2022Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.CVE-2022-3608 · Other software · thorsten · reported by security@huntr.devHigh 8.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attackCVE-2022-36877 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 2.8
Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attackers to access device identification via log.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 30, 2022Easy FAQ with Expanding Text: Does not sanitise and escape its settingsCVE-2022-1395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Easy FAQ with Expanding Text
- Affected
- up to 3.2.8.3.1
- What to do
- Affects up to 3.2.8.3.1. Update Easy FAQ with Expanding Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022HTML5 Responsive FAQ: Does not properly sanitise and escape some of its settingsCVE-2021-24995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- HTML5 Responsive FAQ
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update HTML5 Responsive FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2022Ultimate FAQ: Does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actionsCVE-2021-24968 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
- Product
- Ultimate FAQ
- Fixed in
- 2.1.2
- What to do
- Update Ultimate FAQ to 2.1.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
- Product
- duoFAQ - Responsive, Flat, Simple FAQ WordPess
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_faqs() function in the FAQ Builder AYS
- Fixed in
- 1.3.6
- What to do
- Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Mar 22, 2021Agents are able to see linked FAQ articles without permissions (defined in FAQ Category).CVE-2021-21438 · Other software · OTRS AG · reported by security@otrs.comLow 3.5
Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.
- Product
- FAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ.CVE-2020-15217 · Other software · glpi-project · reported by GitHubMedium 5.3
In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faCVE-2020-12706 · Websites & servers · Php-fusion · reported by MITREMedium 5.4
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php
- Product
- Php-fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2020A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, aCVE-2013-2637 · Other software · Otrs · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
- Product
- FAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.