Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
585 results · page 7 of 12
Oct 31, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36508 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.
- Product
- Contact Form to DB by BestWebSoft – Messages Database Plugin For
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.CVE-2023-46451 · Other software · Mayurik · reported by MITREMedium 5.4
Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.
- Product
- Best Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities.CVE-2023-46117 · Other software · six2dez · reported by GitHubHigh 8.8
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- reconftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023 The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.CVE-2023-43611 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.CVE-2023-44233 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.
- Affected
- up to 2.2.44
- What to do
- Affects up to 2.2.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 6, 2023Profile Extra Fields by BestWebSoft: Unauthorized access of dataCVE-2023-4469 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially sensitive user data, including data entered into custom fields.
- Product
- Profile Extra Fields by BestWebSoft
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Profile Extra Fields by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 15, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection.CVE-2023-4833 · Other software · Besttem · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6.
- Product
- Network Marketing Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 9, 2023Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, AuthenticatioCVE-2023-3632 · Other software · Sifir Bes Education and Informatics · reported by iletisim@usom.gov.trCritical 9.8
Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass. This issue affects Kunduz - Homework Helper App: before 6.2.3.
- Product
- Kunduz - Homework Helper App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-23757 · Other software · bestaddon.com · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- BA Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 2, 2023 The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.CVE-2023-38418 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.CVE-2023-31998 · Network & remote access · Ubiquiti · reported by support@hackerone.comHigh 7.5
A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
- Product
- EdgeRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Jun 8, 2023Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative cCVE-2023-33443 · Other software · Besder · reported by MITRECritical 9.8
Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints.
- Product
- Videoplaytool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress.CVE-2014-125103 · WordPress plugins & themes · reported by VulDBLow 2.4
A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function twttr_settings_page of the file twitter.php. The manipulation of the argument twttr_url_twitter/bws_license_key/bws_license_plugin leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The patch is named e04d59ab578316ffeb204cf32dc71c0d0e1ff77c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230155.
- Product
- BestWebSoft Twitter
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update BestWebSoft Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29745 · Other software · Bestweather Project · reported by MITREHigh 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.CVE-2023-29742 · Other software · Bestweather Project · reported by MITREHigh 7.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress.CVE-2012-10015 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
- Product
- BestWebSoft Twitter
- Affected
- up to 2.14
- What to do
- Affects up to 2.14. Update BestWebSoft Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.CVE-2023-29743 · Other software · Bestweather Project · reported by MITREHigh 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.CVE-2023-29741 · Other software · Bestweather Project · reported by MITRECritical 9.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
- Product
- Bestweather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and deCVE-2023-33186 · Other software · zulip · reported by GitHubHigh 8.2
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2023A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress.CVE-2014-125102 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The identifier of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.
- Product
- Bestwebsoft Relevant
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Bestwebsoft Relevant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.CVE-2022-47136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2023Gallery by BestWebSoft: Does not properly escape values used in SQL queriesCVE-2023-0765 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
- Product
- Gallery by BestWebSoft
- Fixed in
- 4.7.0
- What to do
- Update Gallery by BestWebSoft to 4.7.0 or newer.
Apr 17, 2023Gallery by BestWebSoft: Does not perform proper sanitization of gallery informationCVE-2023-0764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.
- Product
- Gallery by BestWebSoft
- Fixed in
- 4.7.0
- What to do
- Update Gallery by BestWebSoft to 4.7.0 or newer.
Apr 14, 2023SQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cause a denial of serviCVE-2023-27649 · Other software · Bestools · reported by MITREHigh 7.5
SQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cause a denial of service via the search history table
- Product
- Trusted Tools Free Music
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbestools.groupgithub.com
Apr 10, 2023A vulnerability, which was classified as problematic, was found in BestWebSoft Facebook Like Button up to 2.33.CVE-2014-125097 · Other software · BestWebSoft · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in BestWebSoft Facebook Like Button up to 2.33. Affected is the function fcbkbttn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.34 is able to address this issue. The patch is identified as b766da8fa100779409a953f0e46c2a2448cbe99c. It is recommended to upgrade the affected component. VDB-225354 is the identifier assigned to this vulnerability.
- Product
- Facebook Like Button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic.CVE-2012-10012 · Other software · BestWebSoft · reported by VulDBMedium 4.3
A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The patch is named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225355.
- Product
- Facebook Like Button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic.CVE-2014-125095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
- Affected
- 1.3.4 to 1.3.4
- What to do
- Affects 1.3.4 to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form 3.21.CVE-2012-10010 · Other software · BestWebSoft · reported by VulDBMedium 4.3
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
- Product
- Contact Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.CVE-2022-46793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
- Fixed in
- 12.4.5
- What to do
- Update the plugin to 12.4.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 5, 2023A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress.CVE-2013-10022 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
- Affected
- 3.51 to 3.51
- What to do
- Affects 3.51 to 3.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2023User Role by BestWebSoft: Does not protect against CSRF in requests to update role capabilitiesCVE-2023-0820 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
- Product
- User Role by BestWebSoft
- Fixed in
- 1.6.7
- What to do
- Update User Role by BestWebSoft to 1.6.7 or newer.
Mar 9, 2023A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML viCVE-2023-27206 · Other software · Mayurik · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
- Product
- Best POS Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 9, 2023Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.CVE-2023-27205 · Other software · Mayurik · reported by MITRECritical 9.8
Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.
- Product
- Best POS Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 9, 2023Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.CVE-2023-27204 · Other software · Mayurik · reported by MITRECritical 9.8
Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
- Product
- Best POS Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 9, 2023Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php.CVE-2023-27203 · Other software · Mayurik · reported by MITRECritical 9.8
Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php.
- Product
- Best POS Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Mar 9, 2023Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php.CVE-2023-27202 · Other software · Mayurik · reported by MITRECritical 9.8
Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php.
- Product
- Best POS Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versionsCVE-2022-46862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.
- Fixed in
- 8.0.8
- What to do
- Update the plugin to 8.0.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.CVE-2022-45807 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2023In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN fiCVE-2022-30904 · Other software · Bestechnic · reported by MITREHigh 8.2
In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU.
- Product
- Bluetooth Mesh Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orggithub.com
Jan 3, 2023Survey Maker – Best WordPress Survey: Stored Cross-Site ScriptingCVE-2023-0038 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
- Product
- Survey Maker – Best WordPress Survey
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Survey Maker – Best WordPress Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 21, 2022BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES SuCVE-2022-38655 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
- Product
- BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 7, 2022qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwCVE-2022-46770 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).
- Product
- Mirage Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 14, 2022Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CCVE-2022-43294 · Other software · Tasmota Project · reported by MITRECritical 9.8
Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CRtspSession.cpp.
- Product
- Tasmota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Post to CSV by BestWebSoft: Does not properly escape fieldsCVE-2022-3393 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
- Product
- Post to CSV by BestWebSoft
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2022Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.CVE-2022-42021 · Other software · Best Student Result Management System Project · reported by MITRECritical 9.8
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.
- Product
- Best Student Result Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Besu is a Java-based Ethereum client.CVE-2022-36025 · Other software · hyperledger · reported by GitHubCritical 9.1
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. This issue is patched in version 22.7.1. As a workaround, reverting to version 22.1.3 or earlier will prevent incorrect execution.
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022nitrado.js is a type safe wrapper for the Nitrado API.CVE-2022-36034 · Other software · cainthebest · reported by GitHubHigh 7.5
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
- Product
- nitrado.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.