Updated 22 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

538 results · page 6 of 11

Apr 24, 2023Ajax Search Pro: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-1435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Search Pro
Fixed in
4.26.2
What to do
Update Ajax Search Pro to 4.26.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023WP VR: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2023-1414 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
Product
WP VR
Fixed in
8.3.0
What to do
Update WP VR to 8.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 10, 2023NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arCVE-2023-27852 · Network & remote access · Netgear · reported by vulnreport@tenable.comCritical 9.8
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device.
Product
Rax30 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Mar 9, 2023An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands.CVE-2021-34125 · Other software · Dronecode · reported by MITREHigh 7.5
An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands.
Product
Px4 Drone Autopilot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
Product
BackupBuddy
Fixed in
8.8.3
What to do
Update BackupBuddy to 8.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 15, 2023Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (CVE-2023-25763 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.
Product
Jenkins Email Extension Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Feb 13, 2023Simple URLs: Does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated usersCVE-2023-0098 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Product
Simple URLs
Fixed in
115
What to do
Update Simple URLs to 115 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 10, 2023An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-4338 · Other software · Openvswitch · reported by Red HatCritical 9.8
An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
Product
Openvswitch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mail.openvswitch.org
Jan 10, 2023An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-4337 · Other software · Openvswitch · reported by Red HatCritical 9.8
An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
Product
Openvswitch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mail.openvswitch.org
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
Product
Welcart e-Commerce
Fixed in
2.8.6
What to do
Update Welcart e-Commerce to 2.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various AJAX actionsCVE-2022-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 16, 2022In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code.CVE-2022-20562 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-231630423References: N/A
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 16, 2022In onCreate of various files, there is a possible tapjacking/overlay attack.CVE-2022-20520 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203202
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Lacks authorization in various AJAX actionsCVE-2022-2450 · WordPress plugins & themes · reported by WPScanMedium 4.3
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Product
reSmush.it : the only free Image Optimizer & compress
Fixed in
0.4.4
What to do
Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 4, 2022XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki.CVE-2022-39387 · Other software · xwiki-contrib · reported by GitHubCritical 9.1
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider. With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup. This issue has been patched, please upgrade to 1.29.1. There is no workaround, an upgrade of the authenticator is required.
Product
oidc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 2, 2022Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.CVE-2022-39379 · Other software · fluent · reported by GitHubLow 3.1
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
Product
fluentd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2022A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_CVE-2022-43402 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.9
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Product
Jenkins Pipeline: Groovy Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Oct 19, 2022A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_CVE-2022-43401 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.9
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Product
Jenkins Script Security Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Oct 14, 2022In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code.CVE-2022-20464 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-236042696References: N/A
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Oct 13, 2022Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers CVE-2022-42720 · Other software · Siemens · reported by MITREHigh 7.8
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Sep 28, 2022Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by sCVE-2014-0147 · Other software · Qemu · reported by Red HatMedium 6.2
Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.
Product
Qemu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.qemu.org rhn.redhat.com
Sep 28, 2022QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflCVE-2014-0144 · Other software · Qemu · reported by Red HatHigh 8.6
QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.
Product
Qemu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.qemu.org git.qemu.org
Sep 26, 2022A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software.CVE-2022-3204 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discover
Product
Unbound
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Product
Zephyr Project Manager
Fixed in
3.2.5
What to do
Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Aug 25, 2022Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.CVE-2022-29850 · Other software · Lexmark · reported by MITREHigh 8.1
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.
Product
B2236 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record publications.lexmark.com support.lexmark.com
Jul 17, 2022Insights from Google PageSpeed: Does not verify for CSRF before doing various actions suchCVE-2022-1672 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
Product
Insights from Google PageSpeed
Fixed in
4.0.7
What to do
Update Insights from Google PageSpeed to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2022In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free.CVE-2022-20228 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-213850092
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jul 4, 2022WP Championship: Is lacking CSRF checks in various placesCVE-2022-1967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Product
WP Championship
Fixed in
9.3
What to do
Update WP Championship to 9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
Product
WP Post Styling
Fixed in
1.3.1
What to do
Update WP Post Styling to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022MailPress: Does not have CSRF checks in various placesCVE-2022-1843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
Product
MailPress
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update MailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2022An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password serviceCVE-2022-32550 · Other software · 1password · reported by MITREMedium 4.8
An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.
Product
1password
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.1password.com support.1password.com
Jun 15, 2022In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow.CVE-2022-20166 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jun 8, 2022Note Press: Does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboardCVE-2022-1688 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
Product
Note Press
Affected
up to 0.1.10
What to do
Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
Product
Cube Slider
Affected
up to 1.2
What to do
Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
Product
Content Mask
Fixed in
1.8.4.1
What to do
Update Content Mask to 1.8.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 19, 2022Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow CVE-2020-14496 · Other software · Mitsubishi Electric · reported by ics-cert@hq.dhs.govHigh 8.3
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.
Product
CPU Module Logging Configuration Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 16, 2022The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensCVE-2021-27444 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 9.8
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Product
cMT-SVR-1xx/2xx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.weintek.com cisa.gov
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not escape various settings before outputting them in attributesCVE-2022-1408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
VikBooking Hotel Booking Engine & PMS
Fixed in
1.5.8
What to do
Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
Product
Visual Slide Box Builder
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 11, 2022On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root CVE-2022-29898 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.1
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.
Product
RAD-ISM-900-EN-BD/B
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
May 11, 2022On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with rooCVE-2022-29897 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.1
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.
Product
RAD-ISM-900-EN-BD/B
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
May 10, 2022In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check.CVE-2022-20009 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.8
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213172319References: Upstream kernel
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
Product
Ubigeo de Perú para Woocommerce
Fixed in
3.6.4
What to do
Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 29, 2022Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.CVE-2021-43938 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.1
Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.
Product
SmartPTT SCADA Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
LayerSlider
Fixed in
7.1.2
What to do
Update LayerSlider to 7.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.CVE-2021-42782 · Other software · Opensc Project · reported by Red HatMedium 5.3
Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
Product
Opensc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com github.com
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Product
Portfolio Gallery, Product Catalog
Fixed in
2.1.0
What to do
Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Product
Insights from Google PageSpeed
Fixed in
4.0.4
What to do
Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 18, 2022Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sysCVE-2020-25176 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govCritical 9.1
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
Product
ISaGRAF Runtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com rockwellautomation.custhelp.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.