Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
35added in the last 30 days
575new WordPress flaws this week
391,358entries in the database

2,813 results · page 57 of 57

  • Jul 8, 2009SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2009-2383 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.

    Product
    Related Sites
    What to do
    Update Related Sites to the newest version.

    Full record and what to do →NVD recordexploit-db.comsecurityfocus.com

  • Jun 22, 2009SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2009-2144 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Product
    SQL injection vulnerability in the FireStats
    Fixed in
    1.6.2-stable
    What to do
    Update SQL injection vulnerability in the FireStats to 1.6.2-stable or newer.

    Full record and what to do →NVD recordfirestats.ccsecunia.com

  • Jun 19, 2009SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-2122 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Product
    Paolo Palmonari Photoracer
    What to do
    Update Paolo Palmonari Photoracer to the newest version.

    Full record and what to do →NVD recordsecunia.comsecurityfocus.com

  • Mar 19, 2009SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameteCVE-2009-0968 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.

    Product
    fMoblog
    What to do
    Update fMoblog to the newest version.

    Full record and what to do →NVD recordosvdb.orgsecunia.com

  • Jul 30, 2008upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for: Unrestricted file uploadCVE-2008-3362 · WordPress plugins & themes · reported by MITREHigh 10

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.

    Product
    upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for
    What to do
    Update upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for to the newest version.

    Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com

  • Feb 11, 2008SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via tCVE-2008-0682 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Product
    SQL injection vulnerability in wordspew-rss.php in the Wordspew
    Fixed in
    3.72
    What to do
    Update SQL injection vulnerability in wordspew-rss.php in the Wordspew to 3.72 or newer.

    Full record and what to do →NVD recordpierre.sudarovich.free.frsecunia.com

  • Jan 31, 2008Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commandsCVE-2008-0520 · WordPress plugins & themes · reported by MITREHigh 7.5

    Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

    Product
    Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4
    Affected
    up to 1.4.3
    What to do
    Affects up to 1.4.3. Update Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecunia.comsecurityfocus.com

  • Jan 10, 2008ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for: Unrestricted file uploadCVE-2008-0222 · WordPress plugins & themes · reported by MITREHigh 7.5

    Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.

    Product
    ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for
    What to do
    Update ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for to the newest version.

    Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com

  • Jul 20, 2007index.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-3939 · WordPress plugins & themes · reported by MITREMedium 6.8

    SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.

    Product
    index.php in SpoonLabs Vivvo Article Management CMS
    Affected
    up to 3.4
    What to do
    Affects up to 3.4. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

  • Jan 30, 2007rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2007-0574 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

    Product
    rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS
    What to do
    Update rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS to the newest version.

    Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

  • Sep 12, 2006pdf_version.php in SpoonLabs Vivvo Article Management CMS: SQL injectionCVE-2006-4715 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Product
    pdf_version.php in SpoonLabs Vivvo Article Management CMS
    Affected
    up to 3.2
    What to do
    Affects up to 3.2. Update pdf_version.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecunia.comsecuritydot.net

  • Sep 12, 2006index.php in SpoonLabs Vivvo Article Management CMS: PHP remote file inclusionCVE-2006-4714 · WordPress plugins & themes · reported by MITREMedium 5.1

    PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.

    Product
    index.php in SpoonLabs Vivvo Article Management CMS
    Affected
    up to 3.2
    What to do
    Affects up to 3.2. Update index.php in SpoonLabs Vivvo Article Management CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

    Full record and what to do →NVD recordsecunia.comsecuritydot.net

  • Nov 26, 2005phpWordPress PHP News and Article Manager 3.0: SQL injectionCVE-2005-3844 · WordPress plugins & themes · reported by MITREHigh 7.5

    SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.

    Product
    phpWordPress PHP News and Article Manager 3.0
    What to do
    Update phpWordPress PHP News and Article Manager 3.0 to the newest version.

    Full record and what to do →NVD recordforum.word-press.netpridels0.blogspot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.