Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
665 results · page 6 of 14
Oct 29, 2024Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50426 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.0.2.
- Product
- Survey Maker
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2024secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1.CVE-2024-48930 · Other software · cryptocoinjs · reported by GitHubHigh 8.7
secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, `loadCompressedPublicKey` is missing that check. That allows the attacker to use public keys on low-cardinality curves to extract enough information to fully restore the private key from as little as 11 ECDH sessions, and very cheaply on compute power. Other operations on public keys are also affected, including e.g. `publicKeyVerify()` incorrectly returning `true` on those invalid keys, and e.g. `publicKeyTweakMul()` also returning predictable outcomes allowing to restore the tweak. Versions 5.0.1, 4.0.4, and 3.8.1 contain a fix for the issue.
- Product
- secp256k1-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads oCVE-2024-9143 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 4.3
Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the abov
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024TS Poll – Survey, Versus Poll, Image Poll, Video Poll: SQL InjectionCVE-2024-9022 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update TS Poll – Survey, Versus Poll, Image Poll, Video Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Oct 9, 2024The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" vaCVE-2024-48949 · Other software · Indutny · reported by MITRECritical 9.1
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
- Product
- Elliptic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comgithub.com
Oct 9, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45179 · Other software · za-internet · reported by MITREHigh 7.2
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Survey Maker: Stored Cross-Site ScriptingCVE-2024-8488 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Survey Maker
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 7, 2024Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and outpuCVE-2024-28710 · Other software · Limesurvey · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and cCVE-2024-28709 · Other software · Limesurvey · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.CVE-2024-46325 · Network & remote access · tp-link · reported by MITREMedium 5.5
TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.
- Product
- wr740n_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-9528 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2024TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm.CVE-2024-46313 · Network & remote access · tp-link · reported by MITREHigh 8
TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm.
- Product
- tl-wr941nd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-8758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.3
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.3 or newer.
Sep 10, 2024An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.CVE-2024-6596 · Other software · Endress+Hauser · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Product
- Echo Curve Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45176 · Other software · C-mor · reported by MITREMedium 6.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting (XSS) attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to insufficient user input validation.
- Product
- C-mor Video Surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45175 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a path traversal attack, has access to the login data of all configured cameras, or the configured FTP server.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45171 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup files allows an authenticated user to upload arbitrary files. The only condition is that the filename contains a .cbkf string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are stored within the directory "/srv/www/backups" on the C-MOR system, and can thus be accessed via the URL https://<HOST>/backup/upload_<FILENAME>. Due to broken access control, low-privileged authenticated users can also use this file upload functionality.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45178 · Other software · za-internet · reported by MITREHigh 7.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45173 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45172 · Other software · za-internet · reported by MITREMedium 6.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerable to cross-site request forgery (CSRF) attacks. The C-MOR web interface offers no protection against cross-site request forgery (CSRF) attacks.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45177 · Other software · za-internet · reported by MITREMedium 5.4
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting (XSS) attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site scripting attack due to insufficient user input validation.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45174 · Other software · za-internet · reported by MITREHigh 8.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrary SQL commands in the context of the corresponding MySQL database.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45170 · Other software · za-internet · reported by MITREHigh 8.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, access those functions is restricted via the web application user interface and not checked on the server side. Thus, by sending corresponding HTTP requests to the web server of the C-MOR web interface, low privileged users can also use administrative functionality, for instance downloading backup files or changing configuration settings.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-syss-de.translate.googsyss.de
Sep 3, 2024A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password rCVE-2024-42903 · Other software · Limesurvey · reported by MITREMedium 6.5
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lngCVE-2024-42902 · Other software · limesurvey · reported by MITREHigh 8.8
An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.limesurvey.orggithub.com
Sep 3, 2024A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.CVE-2024-42901 · Other software · limesurvey · reported by MITREMedium 4.8
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Unauthorized Malichimp API key updateCVE-2024-5053 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.18
- What to do
- Affects up to 5.1.18. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024azurecurve Toggle Show/Hide: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stored XSS.This issue affects azurecurve Toggle Show/Hide: from n/a through 2.1.3.
- Product
- azurecurve Toggle Show/Hide
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update azurecurve Toggle Show/Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.1
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.1 or newer.
Aug 21, 2024Centreon initCurveList SQL Injection Remote Code Execution Vulnerability.CVE-2024-5725 · Other software · Centreon · reported by zdi-disclosures@trendmicro.comHigh 8.8
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comthewatch.centreon.com
Aug 21, 2024LiquidPoll – Polls, Surveys, NPS and Feedback Reviews: Stored Cross-Site ScriptingCVE-2024-7134 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘form_data’ parameter in all versions up to, and including, 3.3.78 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LiquidPoll – Polls, Surveys, NPS and Feedback Reviews
- Affected
- up to 3.3.78
- What to do
- Affects up to 3.3.78. Update LiquidPoll – Polls, Surveys, NPS and Feedback Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 21, 2024WordSurvey: Stored Cross-Site ScriptingCVE-2024-6767 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sounding_title’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WordSurvey
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update WordSurvey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 17, 2024A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic.CVE-2024-7887 · Other software · limesurvey · reported by VulDBMedium 5.1
A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.0
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.0 or newer.
Jul 31, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2024-6725 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Affected
- up to 6.11.1
- What to do
- Affects up to 6.11.1. Update Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6703 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6521 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6520 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6518 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 20, 2024A flaw has been found in LimeSurvey 6.5.14-240624.CVE-2024-6933 · Other software · limesurvey · reported by VulDBLow 2.1
A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 6.6.2+240827 can resolve this issue. Patch name: d656d2c7980b7642560977f4780e64533a68e13d. You should upgrade the affected component.
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.limesurvey.orggithub.com
Jul 12, 2024User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Stored Cross-Site ScriptingCVE-2024-5902 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in feedback form responses that will execute whenever a high-privileged user tries to view them.
- Product
- User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.5
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.5 or newer.
Jul 9, 2024Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2024-39063 · Other software · limesurvey · reported by MITREHigh 8.8
Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.
- Product
- limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024When almost out-of-memory an elliptic curve key which was never allocated could have been freed again.CVE-2024-6609 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
- Product
- Quiz And Survey Master
- Affected
- up to 8.1.16
- What to do
- Affects up to 8.1.16. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Sensitive Information ExposureCVE-2024-4266 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
- Product
- MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 7, 2024Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: SQL InjectionCVE-2024-3592 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-5606 appears to be a duplicate of this issue.
- Product
- Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
- Affected
- up to 9.0.1
- What to do
- Affects up to 9.0.1. Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 22, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: PHP Object InjectionCVE-2024-4157 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have "View Form" and "Manage Form" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.15
- What to do
- Affects up to 5.1.15. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.