Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
448 results · page 6 of 9
Mar 15, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2023-51489 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 23, 2024In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction.CVE-2024-24309 · Other software · ecomiz · reported by MITREHigh 7.5
In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction.
- Product
- ecomiz_survey_tma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgecomiz.com
Feb 22, 2024User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Stored Cross-Site ScriptingCVE-2024-0903 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the feedback submission page that will execute when a user clicks the link, while also pressing the command key.
- Product
- User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 10, 2024Crowdsignal Dashboard – Polls, Surveys & more: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51488 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 5, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-0660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Affected
- up to 6.7.2
- What to do
- Affects up to 6.7.2. Update Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: from n/a through 2.0.4.1.
- Product
- Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
- Affected
- up to 2.0.4.1
- What to do
- Affects up to 2.0.4.1. Update Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: from n/a through 0.6.2.
- Product
- Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 23, 2024Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey EditioCVE-2024-21796 · Other software · Ministry of Defense · reported by vultures@jpcert.or.jpMedium 5.5
Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- Product
- Electronic Deliverables Creation Support Tool (Construction Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Stored Cross-Site ScriptingCVE-2023-6828 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2023-6842 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.
- Product
- Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versioCVE-2023-47834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.
- Affected
- up to 8.1.13
- What to do
- Affects up to 8.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 17, 2023Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _CVE-2023-44796 · Other software · Limesurvey · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Microsoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityCVE-2023-36007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
- Product
- Send Customer Voice survey from Dynamics 365 app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versionCVE-2023-26524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
- Affected
- up to 8.0.10
- What to do
- Affects up to 8.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.CVE-2023-46543 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.
- Product
- x2000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (withinCVE-2023-45208 · Network & remote access · d-link · reported by MITREHigh 8.8
A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.
- Product
- dap-x1860
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredteam-pentesting.deredteam-pentesting.de
Sep 1, 2023File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile CVE-2023-40980 · Other software · Diaowen · reported by MITRECritical 9.8
File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file.
- Product
- Dwsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Quiz And Survey Master
- Fixed in
- 8.1.11
- What to do
- Update Quiz And Survey Master to 8.1.11 or newer.
Aug 2, 2023Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the passwordCVE-2022-46484 · Other software · Ngsurvey · reported by MITREHigh 7.5
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.
- Product
- Ngsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment FieldCVE-2022-46485 · Other software · Ngsurvey · reported by MITREHigh 7.5
Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".
- Product
- Ngsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript CVE-2023-38057 · Other software · OTRS AG · reported by security@otrs.comMedium 4.1
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module).CVE-2023-22035 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Scripting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Scripting accessible data as well as unauthorized read access to a subset of Oracle Scripting accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Scripting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameter of the qu-multi-fiCVE-2020-20070 · Other software · Diaowen · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameter of the qu-multi-fillblank!answers.action file.
- Product
- Dwsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023Quiz And Survey Master: Cross-Site Request ForgeryCVE-2023-0292 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Quiz And Survey Master
- Affected
- up to 8.0.8
- What to do
- Affects up to 8.0.8. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jun 9, 2023Quiz And Survey Master: Authorization bypassCVE-2023-0291 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
- Product
- Quiz And Survey Master
- Affected
- up to 8.0.8
- What to do
- Affects up to 8.0.8. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jun 5, 2023Survey Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2572 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Survey Maker
- Fixed in
- 3.4.7
- What to do
- Update Survey Maker to 3.4.7 or newer.
Apr 11, 2023Microsoft Dynamics 365 Customer Voice Cross-Site Scripting VulnerabilityCVE-2023-28313 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability
- Product
- Send Customer Voice survey from Dynamics 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Novi Survey Insecure Deserialization VulnerabilityCVE-2023-29492 · Other software · Novi Survey · reported by MITREExploitedCritical 9.8
Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
- Product
- Novi Survey
- On CISA’s list since
- Apr 13, 2023 (federal fix deadline May 4, 2023)
- What to do
- Attackers are using this now. Install Novi Survey’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalognovisurvey.netnovisurvey.net
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versionsCVE-2022-46862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.
- Fixed in
- 8.0.8
- What to do
- Update the plugin to 8.0.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 27, 2023LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenuliCVE-2022-48010 · Other software · Limesurvey · reported by MITREMedium 5.4
LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-48008 · Other software · Limesurvey · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveCVE-2023-23490 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.
- Fixed in
- 3.1.2
- What to do
- Update the plugin to 3.1.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 3, 2023Survey Maker – Best WordPress Survey: Stored Cross-Site ScriptingCVE-2023-0038 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
- Product
- Survey Maker – Best WordPress Survey
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Survey Maker – Best WordPress Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2022Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module.CVE-2022-44790 · Other software · Interspire · reported by MITREHigh 7.5
Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists.
- Product
- Email Marketer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinterspire.cominterspire.com
Nov 29, 2022Quiz and Survey Master: Input validation bypassCVE-2022-4033 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
- Product
- Quiz and Survey Master
- Affected
- up to 8.0.4
- What to do
- Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2022Quiz and Survey Master: IFrame InjectionCVE-2022-4032 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.
- Product
- Quiz and Survey Master
- Affected
- up to 8.0.4
- What to do
- Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
- Affected
- up to 7.3.10
- What to do
- Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-41652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
- Affected
- up to 7.3.10
- What to do
- Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 15, 2022LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.CVE-2022-43279 · Other software · limesurvey · reported by MITREHigh 7.2
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrick-pamphlet-d24.notion.sitegithub.com
Nov 3, 2022Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.CVE-2021-36906 · WordPress plugins & themes · reported by PatchstackLow 2.7
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 1, 2022Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMLCVE-2022-3306 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2022Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMLCVE-2022-3305 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 11, 2022Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .phCVE-2022-40777 · Other software · Interspire · reported by MITREHigh 8.8
Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550.
- Product
- Email Marketer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.cominterspire.com
Sep 30, 2022ExpressTech Quiz And Survey Master plugin <= 7.3.4 at: Insecure direct object references (IDOR)CVE-2021-36865 · WordPress plugins & themes · reported by PatchstackLow 3.8
Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
- Product
- ExpressTech Quiz And Survey Master plugin <= 7.3.4 at
- Affected
- up to 7.3.4
- What to do
- Affects up to 7.3.4. Update ExpressTech Quiz And Survey Master plugin <= 7.3.4 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.CVE-2022-34656 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 24, 2022A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a cCVE-2022-29710 · Other software · Limesurvey · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.CVE-2022-29728 · Other software · Surveysparrow · reported by MITREMedium 6.1
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.
- Product
- Enterprise Survey Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsurveysparrow.com
May 11, 2022Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.CVE-2022-29727 · Other software · Surveysparrow · reported by MITREMedium 5.4
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.
- Product
- Enterprise Survey Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 25, 2022SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cachCVE-2022-25590 · Other software · Surveyking · reported by MITREMedium 6.5
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.
- Product
- Surveyking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CVE-2022-26249 · Other software · Surveyking Project · reported by MITRECritical 9.8
Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.
- Product
- Surveyking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.