Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

4,746 results · page 56 of 95

Apr 9, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Sensitive Information ExposureCVE-2024-2974 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.9.13 via the load_more function. This can allow unauthenticated attackers to extract sensitive data including private and draft posts.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.13
What to do
Affects up to 5.9.13. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Avada: Sensitive Information ExposureCVE-2024-2340 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.
Product
Avada
Affected
up to 7.11.6
What to do
Affects up to 7.11.6. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Apr 9, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Sensitive Information ExposureCVE-2024-2302 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
Product
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy)
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Event Tickets and Registration: Sensitive Information ExposureCVE-2024-2261 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.
Product
Event Tickets and Registration
Affected
up to 5.8.2
What to do
Affects up to 5.8.2. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Sensitive Information ExposureCVE-2024-2112 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.22
What to do
Affects up to 1.15.22. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024VK All in One Expansion Unit: Sensitive Information ExposureCVE-2024-2093 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.
Product
VK All in One Expansion Unit
Affected
up to 9.95.0.1
What to do
Affects up to 9.95.0.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 9, 2024Video Conferencing with Zoom: Sensitive Information ExposureCVE-2024-2033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all users on a site.
Product
Video Conferencing with Zoom
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Newsmatic: Sensitive Information ExposureCVE-2024-1587 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. This makes it possible for unauthenticated attackers to view draft posts and post content.
Product
Newsmatic
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Newsmatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Apr 9, 2024Watu Quiz: Sensitive Information ExposureCVE-2024-0872 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user meta data which can include session tokens and user emails.
Product
Watu Quiz
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score: Sensitive Information ExposureCVE-2023-7046 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
Affected
up to 7.0
What to do
Affects up to 7.0. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WP Reset – Most Advanced WordPress Reset Tool: Sensitive Information ExposureCVE-2023-6799 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.
Product
WP Reset – Most Advanced WordPress Reset Tool
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Reset – Most Advanced WordPress Reset Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Beaver Themer: Sensitive Information ExposureCVE-2023-6695 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including arbitrary user_meta values.
Product
Beaver Themer
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Beaver Themer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbeaverbuilder.com
Apr 9, 2024An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.CVE-2024-23662 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.
Product
FortiOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Apr 8, 2024The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.CVE-2024-23584 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.
Product
BigFix Enterprise Suite Asset Discovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 8, 2024DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0.CVE-2024-30269 · Other software · dataease · reported by GitHubMedium 5.3
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Product
dataease
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 8, 2024In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.shCVE-2024-31815 · Other software · totolink · reported by MITRECritical 9.1
In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh
Product
ex200_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 7, 2024WP Import Export Lite: Deserialization of Untrusted DataCVE-2024-31308 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
Product
WP Import Export Lite
Affected
up to 3.9.26
What to do
Affects up to 3.9.26. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024LearnPress Export Import: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31241 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
Product
LearnPress Export Import
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024BoldGrid Easy SEO – Simple and Effective SEO: Information ExposureCVE-2024-2950 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.14 via meta information (og:description) This makes it possible for unauthenticated attackers to view the first 130 characters of a password protected post which can contain sensitive information.
Product
BoldGrid Easy SEO – Simple and Effective SEO
Affected
up to 1.6.14
What to do
Affects up to 1.6.14. Update BoldGrid Easy SEO – Simple and Effective SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2024WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function.CVE-2023-5692 · WordPress plugins & themes · reported by WordfenceMedium 5.3
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org developer.wordpress.org
Apr 4, 2024projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.CVE-2024-29386 · Other software · projeqtor · reported by MITREMedium 5.4
projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.
Product
projeqtor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.anas-cherni.me cve.anas-cherni.me
Apr 4, 2024 Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of ForCVE-2024-25007 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfHigh 7.1
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.
Product
Ericsson Network Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ericsson.com ericsson.com
Apr 4, 2024Information exposure vulnerability in RT software affecting version 4.4.1.CVE-2024-3262 · Other software · Best Practical Solutions · reported by cve-coordination@incibe.esMedium 5.5
Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.
Product
Request Tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es lists.debian.org
Apr 4, 2024CGC Maintenance Mode: Sensitive Information ExposureCVE-2024-1418 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CGC Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 via the REST API. This makes it possible for unauthenticated attackers to view protected posts via REST API even when maintenance mode is enabled.
Product
CGC Maintenance Mode
Affected
up to 1.2
What to do
Affects up to 1.2. Update CGC Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 2, 2024Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through queCVE-2024-2745 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244.
Product
InsightVM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.rapid7.com docs.rapid7.com
Apr 2, 2024WPFront User Role Editor: Sensitive Information ExposureCVE-2024-2931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.
Product
WPFront User Role Editor
Affected
up to 3.2.1.11184
What to do
Affects up to 3.2.1.11184. Update WPFront User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record inky-knuckle-2c2.notion.site plugins.trac.wordpress.org
Apr 1, 2024Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability.CVE-2023-51573 · Other software · Voltronic Power · reported by zdi-disclosures@trendmicro.comCritical 9.8
Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists within the updateManagerPassword function. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21203.
Product
ViewPower Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.CVE-2024-30860 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
Product
application_security_gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 29, 2024Import Export WordPress Users: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-30492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
Product
Import Export WordPress Users
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Import Export WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024 SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash CVE-2024-27775 · Other software · SysAid · reported by cna@cyber.gov.ilHigh 7.2
SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash
Product
SysAid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il gov.il
Mar 28, 2024Booster Elite for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
Product
Booster Elite for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Elite for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Booster Plus for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process.CVE-2024-29945 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.2
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the DEBUG logging level.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com research.splunk.com
Mar 26, 2024An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2.CVE-2024-25392 · Other software · utilities_project · reported by MITREMedium 5.9
An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2.
Product
utilities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Mar 26, 2024Community by PeepSo: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.0.9.0.
Product
Community by PeepSo
Affected
up to 6.0.9.0
What to do
Affects up to 6.0.9.0. Update Community by PeepSo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Upload Resume: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0.
Product
Upload Resume
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remoteCVE-2023-50895 · Other software · janitza · reported by MITREHigh 7.2
In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remote authenticated administrative users to execute arbitrary Groovy code.
Product
gridvis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code-white.com code-white.com
Mar 26, 2024WholesaleX: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-30233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Product Import Export for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-30231 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.4.1.
Product
Product Import Export for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Product Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0.CVE-2024-29216 · Other software · Sangoma Technologies · reported by vultures@jpcert.or.jpMedium 6.1
Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administrator privilege may perform I/O to arbitrary hardware port or physical address, resulting in erasing or altering the firmware.
Product
cg6kwin2k.sys
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp sangomakb.atlassian.net
Mar 22, 2024Information exposure vulnerability in the CIGESv2 system.CVE-2024-2728 · Other software · Ciges · reported by cve-coordination@incibe.esMedium 4.1
Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol.
Product
CIGESv2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Mar 22, 2024Information exposure vulnerability in the CIGESv2 system.CVE-2024-2725 · Other software · Ciges · reported by cve-coordination@incibe.esHigh 7.5
Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed packages used by the application.
Product
CIGESv2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Mar 21, 2024LiquidPoll – Polls, Surveys, NPS and Feedback Reviews: Sensitive Information ExposureCVE-2024-2080 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.76 via the poller_list shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract information from polls that may be private.
Product
LiquidPoll – Polls, Surveys, NPS and Feedback Reviews
Affected
up to 3.3.76
What to do
Affects up to 3.3.76. Update LiquidPoll – Polls, Surveys, NPS and Feedback Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2024A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console wCVE-2023-42954 · Other software · Claris · reported by product-security@apple.comMedium 4.9
A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests.
Product
FileMaker Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.claris.com support.claris.com
Mar 21, 2024SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter.CVE-2024-29875 · Other software · Sentrifugo · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.
Product
Sentrifugo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Mar 21, 2024Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.CVE-2024-29864 · Other software · distrobox · reported by MITRECritical 9.8
Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
Product
distrobox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 21, 2024In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.CVE-2024-29859 · Other software · misp · reported by MITRECritical 9.8
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
Product
misp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 20, 2024An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component.CVE-2024-28396 · Other software · myprestamodules · reported by MITREHigh 7.5
An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component.
Product
orders_\(csv\,_excel\)_export_pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com security.friendsofpresta.org
Mar 20, 2024Easy Maintenance Mode: Sensitive Information ExposureCVE-2024-1477 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the REST API. This makes it possible for authenticated attackers to obtain post and page content via REST API thus bypassign the protection provided by the plugin.
Product
Easy Maintenance Mode
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Easy Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 20, 2024Coming Soon & Maintenance Mode by Colorlib: Information ExposureCVE-2024-1473 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin.
Product
Coming Soon & Maintenance Mode by Colorlib
Affected
up to 1.0.99
What to do
Affects up to 1.0.99. Update Coming Soon & Maintenance Mode by Colorlib to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.