Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

739 results · page 5 of 15

Feb 19, 2025PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, titleCVE-2023-51299 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, title" parameters.
Product
Hotel Booking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news phpjabbers.com
Feb 19, 2025PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_CVE-2023-51296 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key" parameters which allows attackers to execute arbitrary code
Product
Event Booking Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news phpjabbers.com
Feb 12, 2025Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via localCVE-2024-31068 · Other software · reported by secure@intel.comMedium 5.6
Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com lists.debian.org
Feb 6, 2025Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CCVE-2024-36555 · Other software · reported by MITRECritical 9.8
Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change the device IMEI-number which allows for forging the identity of the device.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record diva-portal.org
Jan 22, 2025CAMOO SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through <= 3.0.1.
Product
CAMOO SMS
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update CAMOO SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specCVE-2024-55414 · Other software · reported by MITRECritical 9.8
A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com us.motorola.com
Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.
Product
SSL Wireless SMS Notification
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SMSA Shipping: Path Traversal: '.../...//'CVE-2024-49249 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.
Product
SMSA Shipping
Affected
up to 2.3
What to do
Affects up to 2.3. Update SMSA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SMS Alert Order Notifications – WooCommerce: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.7.6
What to do
Affects up to 3.7.6. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025WP – Bulk SMS – by SMS.to: Reflected Cross-Site ScriptingCVE-2024-11434 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP – Bulk SMS – by SMS.to
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update WP – Bulk SMS – by SMS.to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 2, 2025In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check.CVE-2024-53834 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com
Jan 2, 2025SendSMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56038 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through <= 1.2.9.
Product
SendSMS
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update SendSMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024SSL Wireless SMS Notification: Incorrect Privilege AssignmentCVE-2024-56220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.
Product
SSL Wireless SMS Notification
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 21, 2024SMSA Shipping(official): Arbitrary file deletionCVE-2024-12066 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue.
Product
SMSA Shipping(official)
Affected
up to 2.3
What to do
Affects up to 2.3. Update SMSA Shipping(official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024SMS for WooCommerce: Cross-Site Request ForgeryCVE-2024-12220 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
SMS for WooCommerce
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update SMS for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2024SMSify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtomic SMSify smsify allows Reflected XSS.This issue affects SMSify: from n/a through <= 6.0.4.
Product
SMSify
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update SMSify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Persian Woocommerce SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.0.5.
Product
Persian Woocommerce SMS
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024TextMe SMS: Missing AuthorizationCVE-2023-48287 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0.
Product
TextMe SMS
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update TextMe SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024SMS for Lead Capture Forms: Unauthorized modification of dataCVE-2024-11353 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message() function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages.
Product
SMS for Lead Capture Forms
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update SMS for Lead Capture Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024افزونه پیامک ووکامرس Persian WooCommerce SMS: Reflected Cross-Site ScriptingCVE-2024-10046 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
افزونه پیامک ووکامرس Persian WooCommerce SMS
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update افزونه پیامک ووکامرس Persian WooCommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024Smart Marketing SMS and Newsletters Forms: Missing AuthorizationCVE-2024-53784 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
Product
Smart Marketing SMS and Newsletters Forms
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 1, 2024Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows attackers to access seCVE-2024-53605 · Other software · handcent · reported by MITREHigh 7.5
Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows attackers to access sensitive data.
Product
nextcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cidy.notion.site
Nov 19, 2024A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server priCVE-2024-48069 · Other software · weaver · reported by MITRECritical 9.8
A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges
Product
e-cology
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Nov 19, 2024Admin SMS Alert: Cross-Site Request Forgery (CSRF)CVE-2024-51637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sroyalty Admin SMS Alert admin-sms-alert allows Stored XSS.This issue affects Admin SMS Alert: from n/a through <= 1.1.0.
Product
Admin SMS Alert
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Admin SMS Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024FraudLabs Pro SMS Verification: Cross-Site Request Forgery (CSRF)CVE-2024-51688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through <= 1.10.1.
Product
FraudLabs Pro SMS Verification
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update FraudLabs Pro SMS Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2024Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentialCVE-2024-21853 · Other software · reported by secure@intel.comMedium 5.7
Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com lists.debian.org
Nov 6, 2024A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specCVE-2024-20537 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to conduct administrative functions beyond their intended access level. To exploit this vulnerability, an attacker would need Read-Only Administrator credentials.
Product
Cisco Identity Services Engine Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Nov 6, 2024A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specCVE-2024-20476 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload files to a location that should be restricted. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials.
Product
Cisco Identity Services Engine Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 29, 2024SMS Alert Order Notifications – WooCommerce: Stored Cross-Site ScriptingCVE-2024-10233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 25, 2024In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check.CVE-2024-47021 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com
Oct 17, 2024افزونه پیامک ووکامرس Persian WooCommerce SMS: Reflected Cross-Site ScriptingCVE-2024-9213 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
افزونه پیامک ووکامرس Persian WooCommerce SMS
Affected
up to 7.0.2
What to do
Affects up to 7.0.2. Update افزونه پیامک ووکامرس Persian WooCommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms.CVE-2024-47123 · Other software · goTenna · reported by ics-cert@hq.dhs.govMedium 6
The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and update to the current release for more secure operations.
Product
Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Sep 26, 2024The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms.CVE-2024-43108 · Other software · goTenna · reported by ics-cert@hq.dhs.govMedium 6
The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the current release for enhanced encryption protocols.
Product
Pro ATAK Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Sep 16, 2024Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via lCVE-2024-24968 · Other software · reported by secure@intel.comMedium 5.6
Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via local access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com lists.debian.org
Sep 15, 2024A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7.CVE-2024-8880 · Other software · playsms · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.
Product
playsms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Aug 26, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-39657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.18
What to do
Affects up to 2.6.18. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0.CVE-2024-37392 · Other software · Smseagle · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.
Product
Smseagle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smseagle.eu
Aug 22, 2024WP SMS: Missing AuthorizationCVE-2024-43331 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.
Product
WP SMS
Affected
up to 6.9.3
What to do
Affects up to 6.9.3. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keysCVE-2021-46746 · Other software · AMD · reported by psirt@amd.comMedium 5.2
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service.
Product
AMD EPYC™ 7001 Processors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com
Aug 12, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43126 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce allows Reflected XSS.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.14.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.14
What to do
Affects up to 2.6.14. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Setting SMS media allows to set GSM modem file.CVE-2024-22123 · Other software · Zabbix · reported by security@zabbix.comLow 2.7
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zabbix.com lists.debian.org
Aug 12, 2024Zabbix allows to configure SMS notifications.CVE-2024-22122 · Other software · Zabbix · reported by security@zabbix.comLow 3
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zabbix.com lists.debian.org
Aug 7, 2024A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote aCVE-2024-41239 · Other software · kashipara · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "class_name" parameter field.
Product
responsive_school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com kashipara.com
Aug 6, 20241Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.CVE-2024-42218 · Other software · 1password · reported by MITREMedium 4.7
1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.
Product
1password
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record app-updates.agilebits.com support.1password.com
Aug 5, 2024oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability.CVE-2024-7547 · Other software · oFono · reported by zdi-disclosures@trendmicro.comHigh 7.8
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
Product
oFono
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Aug 5, 2024oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2024-7537 · Other software · oFono · reported by zdi-disclosures@trendmicro.comMedium 5.5
oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23157.
Product
oFono
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Jul 26, 2024An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files CVE-2024-40116 · Other software · solar-log · reported by MITREHigh 8.1
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Product
solar-log_1000_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com solar-log.com
Jul 4, 2024KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all CVE-2024-36041 · Other software · kde · reported by MITREHigh 7.8
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Product
plasma-workspace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com invent.kde.org
Jul 3, 2024A vulnerability was found in playSMS 1.4.3.CVE-2024-6470 · Other software · playsms · reported by VulDBMedium 5.1
A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=feature_inboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input {{`id`}} leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-270278 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
playsms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Jul 3, 2024A vulnerability was found in playSMS 1.4.3.CVE-2024-6469 · Other software · playsms · reported by VulDBMedium 5.1
A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The manipulation of the argument IP address with the input {{`id`} leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270277 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
playsms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.