Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
977 results · page 6 of 20
Jan 29, 2026Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection.CVE-2020-36999 · Other software · Elaniin · reported by VulnCheckHigh 8.8
Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection. Attackers can bypass authentication by sending crafted email and password parameters with '=''or' payload to login.php, granting unauthorized access to the system.
- Product
- Elaniin CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Recooty – Job Widget (Old Dashboard): Cross-Site Request ForgeryCVE-2025-14616 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce validation on the recooty_save_maybe() function. This makes it possible for unauthenticated attackers to update the recooty_key option and inject malicious content into iframe src attributes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Recooty – Job Widget (Old Dashboard)
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Recooty – Job Widget (Old Dashboard) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2026The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action.CVE-2026-21721 · Other software · Grafana · reported by security@grafana.comHigh 8.1
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Jan 21, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-24042 · Other software · appsmithorg · reported by GitHubCritical 9.4
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripCVE-2021-47855 · Other software · LiteSpeed Technologies · reported by VulnCheckMedium 5.1
Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on the Default Icon.
- Product
- OpenLiteSpeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenlitespeed.orgexploit-db.com
Jan 15, 2026Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help cCVE-2021-47776 · Other software · umbraco · reported by VulnCheckMedium 6.9
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.
- Product
- Umbraco
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordour.umbraco.comreleases.umbraco.com
Jan 14, 2026DASHBOARD BUILDER – WordPress plugin for Charts and Graphs: Cross-Site Request ForgeryCVE-2025-14615 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for unauthenticated attackers to modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The modified SQL query is subsequently executed on the front-end when the shortcode is rendered, enabling arbitrary SQL injection and data exfiltration through the publicly visible chart output.
- Product
- DASHBOARD BUILDER – WordPress plugin for Charts and Graphs
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update DASHBOARD BUILDER – WordPress plugin for Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 12, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-22794 · Other software · appsmithorg · reported by GitHubCritical 9.6
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows aCVE-2026-0747 · Other software · Devolutions · reported by security@devolutions.netLow 3.3
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Dashboard Welcome for Beaver Builder: Missing AuthorizationCVE-2026-22488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.
- Product
- Dashboard Welcome for Beaver Builder
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Dashboard Welcome for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-22032 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026ShareThis Dashboard for Google Analytics: Sensitive Information ExposureCVE-2025-12540 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link.
- Product
- ShareThis Dashboard for Google Analytics
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2026Logo Slider: Does not validate and escape some of its slider options before outputting them back in the dashboardCVE-2025-13153 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.9.0
- What to do
- Update Logo Slider to 4.9.0 or newer.
Dec 31, 2025Dashboard Beacon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49337 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through <= 1.2.0.
- Product
- Dashboard Beacon
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Dashboard Beacon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
- Product
- Sticky Notes for WP Dashboard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.CVE-2025-67255 · Other software · Nagios · reported by MITREHigh 8.8
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permissiCVE-2019-25245 · Other software · Ross Video Ltd. · reported by VulnCheckHigh 8.5
Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permission settings. Attackers can exploit the 'M' or 'C' flags for 'Authenticated Users' group to replace the DashBoard.exe binary with a malicious executable.
- Product
- DashBoard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comrossvideo.com
Dec 18, 2025A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration diCVE-2024-58319 · Other software · Kentico · reported by VulnCheckMedium 5.1
A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users' browsers.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevnet.kentico.comvulncheck.com
Dec 17, 2025Homarr is an open-source dashboard.CVE-2025-67493 · Other software · homarr-labs · reported by GitHubHigh 7.5
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2025-14399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the download_plugin_bulk and download_theme_bulk functions. This makes it possible for unauthenticated attackers to archive all the sites plugins and themes and place them in the `wp-content/uploads/` directory via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 15, 2025Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full seCVE-2025-9122 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.3
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
- Product
- Pentaho Data Integration and Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data CVE-2025-9121 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.
- Product
- Pentaho Data Integration and Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This CVE-2025-10655 · Other software · Frappe · reported by help@fluidattacks.comHigh 8.6
SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
- Product
- Frappe HelpDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Dec 8, 2025Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an adminisCVE-2025-65271 · Other software · Azuriom · reported by MITREHigh 8.8
Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
- Product
- Azuriom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endCVE-2025-34263 · Other software · Advantech Co., Ltd. · reported by VulnCheckMedium 5.1
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and later rendered in the dashboard UI without proper HTML sanitation. An attacker can inject malicious script into either field, which is then executed in the browser context of users who view or interact with the affected dashboard, potentially enabling session compromise and unauthorized actions as the victim.
- Product
- WISE-DeviceOn Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comdocs.deviceon.advantech.com
Dec 4, 2025LaraDashboard is an all-In-one solution to start a Laravel Application.CVE-2025-66509 · Other software · laradashboard · reported by GitHubHigh 8.9
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
- Product
- laradashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitCVE-2021-4472 · Other software · Red Hat · reported by Red HatMedium 6.5
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Product
- Red Hat OpenStack Platform 13 (Queens)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.launchpad.net
Nov 26, 2025Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.CVE-2025-11461 · Other software · Frappe · reported by help@fluidattacks.comHigh 7.1
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.
- Product
- Frappe CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 25, 2025A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.CVE-2025-40890 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comMedium 5.9
A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be socially engineered to import a malicious dashboard template. When the victim views or imports the dashboard, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Nov 25, 2025Chamber Dashboard Business Directory: Unauthorized data exportCVE-2025-13414 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.
- Product
- Chamber Dashboard Business Directory
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Wazuh is a security detection, visibility, and compliance open source project.CVE-2025-64483 · Other software · wazuh · reported by GitHubMedium 5.3
Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0.
- Product
- wazuh-dashboard-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11815 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.08
- What to do
- Affects up to 3.5.08. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11003 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to save templates that contain custom JavaScript.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.09
- What to do
- Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025Homarr is an open-source dashboard.CVE-2025-64759 · Other software · homarr-labs · reported by GitHubHigh 8.1
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-64749 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an existing collection which they are not authorized to access, and when user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. Version 11.13.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-64748 · Other software · directus · reported by GitHubMedium 6.5
Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-64747 · Other software · directus · reported by GitHubMedium 5.5
Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution. Version 11.13.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-64746 · Other software · directus · reported by GitHubMedium 4.6
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level permissions when a field is deleted. When a field is removed from a collection, its reference in the permissions table remains intact. This stale reference creates a security gap: if another field is later created using the same name, it inherits the outdated permission entry. This behavior can unintentionally grant roles access to data they should not be able to read or modify. The issue is particularly risky in multi-tenant or production environments, where administrators may reuse field names, assuming old permissions have been fully cleared. Version 11.13.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulaCVE-2025-64302 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.
- Product
- DeviceOn/iEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64177 · Other software · MatiasDesuu · reported by GitHubMedium 5.4
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filtering. This is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64176 · Other software · MatiasDesuu · reported by GitHubMedium 5.3
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64327 · Other software · MatiasDesuu · reported by GitHubMedium 5.3
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate userCVE-2025-36091 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.
- Product
- Cloud Pak For Business Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before beinCVE-2025-34277 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards.CVE-2025-34273 · Other software · Nagios · reported by VulnCheckHigh 7.1
Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an emptCVE-2025-34272 · Other software · Nagios · reported by VulnCheckMedium 5.3
In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards.CVE-2020-36864 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table.CVE-2016-15049 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality.CVE-2013-10071 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 27, 2025Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execCVE-2025-11682 · Other software · Perx Technologies · reported by vulnerability@ncsc.chHigh 7.1
Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.
- Product
- Customer Engagement & Loyalty Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.