Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
548 results · page 6 of 11
Sep 29, 2025A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0.CVE-2025-56449 · Other software · reported by MITREHigh 8.2
A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gregscharf.comblog.gregscharf.com
Sep 29, 2025IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized acCVE-2025-36351 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions.
- Product
- License Metric Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Password Reset with Code for WordPress REST API: Does not use cryptographically sound algorithms to generate OTP codesCVE-2025-5305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.
- Product
- Password Reset with Code for WordPress REST API
- Fixed in
- 0.0.17
- What to do
- Update Password Reset with Code for WordPress REST API to 0.0.17 or newer.
Sep 3, 2025Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/RCVE-2025-58459 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
- Product
- Jenkins global-build-stats Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Sep 2, 2025A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7.CVE-2025-5662 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privilegCVE-2025-20348 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit th vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 27, 2025A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privilegCVE-2025-20347 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit th vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions, such as accessing sensitive information regarding HTTP Proxy and NTP configurations, uploading images, and damaging image files on an affected device.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 6, 2025In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allCVE-2025-51308 · Other software · Gatling · reported by MITREMedium 5.3
In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks.
- Product
- Gatling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.CVE-2025-52892 · Other software · espocrm · reported by GitHubMedium 4.5
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries aCVE-2025-54554 · Other software · Tera Insights · reported by MITREMedium 5.3
tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.
- Product
- tiCrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-pCVE-2025-20272 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.
- Product
- Cisco Evolved Programmable Network Manager (EPNM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jul 9, 2025The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086).CVE-2025-3499 · Other software · Radiflow · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 10
The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.
- Product
- iSAP Smart Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
- Product
- REST API | Custom API Generator For Cross Platform And Import Export In WP
- Affected
- 1.0.0 to 2.0.3
- What to do
- Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 12, 2025All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver.CVE-2025-49183 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Laravel Rest Api is an API generator.CVE-2025-48490 · Other software · Lomkit · reported by GitHubMedium 6.6
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.
- Product
- laravel-rest-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system.CVE-2025-46823 · Other software · openmrs · reported by GitHubHigh 8
openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. All implementers should update to FHIR2 2.5.0 or newer as soon as is feasible to receive a patch.
- Product
- openmrs-module-fhir2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025The CUBA REST API add-on performs operations on data and entities.CVE-2025-32960 · Other software · cuba-platform · reported by GitHubMedium 6.4
The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.
- Product
- restapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jmix.iodocs.jmix.io
Apr 21, 2025Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exterCVE-2024-12862 · Other software · OpenText · reported by security@opentext.comMedium 5.5
Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4.
- Product
- Content Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025WordPress REST API Authentication: Missing AuthorizationCVE-2025-39545 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.
- Product
- WordPress REST API Authentication
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update WordPress REST API Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API.CVE-2025-32945 · Other software · Framasoft · reported by reefs@jfrog.comMedium 4.3
The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
- Product
- Peertube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Mar 22, 2025WooCommerce Multivendor Marketplace – REST API: SQL InjectionCVE-2025-1311 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WooCommerce Multivendor Marketplace – REST API
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update WooCommerce Multivendor Marketplace – REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API.CVE-2024-12766 · Other software · parisneo · reported by security@huntr.devHigh 7.5
parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter `{"url":"http://steal.target"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)` do not protect against this vulnerability.
- Product
- parisneo/lollms-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrustedCVE-2024-10553 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025REST API TO MiniProgram: Cross-Site Request Forgery (CSRF)CVE-2025-28886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through <= 5.1.2.
- Product
- REST API TO MiniProgram
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025WPGet API – Connect to any external REST API: Server-Side Request ForgeryCVE-2024-13857 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
- Product
- WPGet API – Connect to any external REST API
- Affected
- up to 2.2.10
- What to do
- Affects up to 2.2.10. Update WPGet API – Connect to any external REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 5, 2025Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowinCVE-2025-27623 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowiCVE-2025-27622 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses.CVE-2025-25288 · Other software · octokit · reported by GitHubMedium 5.3
@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.
- Product
- plugin-paginate-rest.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025@octokit/endpoint turns REST API endpoints into generic request options.CVE-2025-25285 · Other software · octokit · reported by GitHubMedium 5.3
@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.
- Product
- endpoint.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Sensei LMS: Does not properly protect some its REST API routesCVE-2025-0466 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
- Product
- Sensei LMS
- Fixed in
- 4.24.4
- What to do
- Update Sensei LMS to 4.24.4 or newer.
Jan 22, 2025A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administraCVE-2025-20156 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
- Product
- Cisco Meeting Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netsec.cloudapps.cisco.com
Jan 17, 2025The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.CVE-2024-50967 · Other software · reported by MITREMedium 6.5
The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatagerry.readthedocs.iogithub.com
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 16, 2024Events Calendar: Is missing access checks in the REST APICVE-2024-5333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
- Product
- Events Calendar
- Fixed in
- 6.8.2.1
- What to do
- Update Events Calendar to 6.8.2.1 or newer.
Dec 11, 2024Ultimate Endpoints With Rest Api: Reflected Cross-Site ScriptingCVE-2024-12260 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Endpoints With Rest Api
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Ultimate Endpoints With Rest Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2024A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perforCVE-2020-3538 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.6
A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to overwrite or list arbitrary files on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a croCVE-2022-20853 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 10, 2024Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License FCVE-2024-48939 · Other software · paxton-access · reported by MITREHigh 7.5
Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.
- Product
- net2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compaxton-access.co.uk
Nov 8, 2024MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API.CVE-2024-52004 · Other software · mediacms-io · reported by GitHubHigh 8.7
MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.
- Product
- mediacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remoteCVE-2024-20536 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a specific REST API endpoint or web-based management interface. A successful exploit could allow the attacker to read, modify, or delete arbitrary data on an internal database, which could affect the availability of the device.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 20, 2024WP REST API FNS: Unrestricted Upload of File with Dangerous TypeCVE-2024-49329 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
- Product
- WP REST API FNS
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP REST API FNS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49328 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
- Product
- WP REST API FNS
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST APICVE-2024-47161 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affeCVE-2024-20477 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2024A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited AdministratoCVE-2024-20442 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions such as viewing portions of the web UI, generating config only or full backup files, and deleting tech support files. This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2024A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on anCVE-2024-20441 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.7
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to download config only or full backup files and learn sensitive configuration information. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2024A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected deviCVE-2024-20438 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.3
A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information, uploading files, and modifying uploaded files. Note: This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2024A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to peCVE-2024-20432 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker to execute arbitrary commands on the CLI of a Cisco NDFC-managed device with network-admin privileges. Note: This vulnerability does not affect Cisco NDFC when it is configured for storage area network (SAN) controller deployment.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 24, 2024REST API TO MiniProgram: Privilege escalationCVE-2024-8485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.
- Product
- REST API TO MiniProgram
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2024REST API TO MiniProgram: SQL InjectionCVE-2024-8484 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- REST API TO MiniProgram
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.