Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 7 of 14
Nov 23, 2022Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.CVE-2022-45278 · Other software · Jizhicms · reported by MITREHigh 8.8
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.CVE-2022-44140 · Other software · Jizhicms · reported by MITREHigh 8.8
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022An issue was discovered in JIZHI CMS 1.9.4.CVE-2021-29334 · Other software · Jizhicms · reported by MITREHigh 8.8
An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 16, 2022A vulnerability, which was classified as problematic, has been found in FeehiCMS.CVE-2022-4014 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The identifier of this vulnerability is VDB-213788.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and NetworkingCVE-2022-25667 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Wired Infrastructure and Networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Nov 9, 2022FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.CVE-2022-43320 · Other software · Feehi · reported by MITREMedium 6.1
FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.CVE-2022-41496 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page mCVE-2022-40408 · Other software · Feehi · reported by MITREMedium 5.4
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.CVE-2020-21516 · Other software · Feehi · reported by MITRECritical 9.8
There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022A directory traversal vulnerability was discovered in Wuzhicms 4.1.0.CVE-2022-36168 · Other software · Wuzhicms · reported by MITRELow 2.7
A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php:
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.CVE-2022-35150 · Other software · Baijiacms Project · reported by MITRECritical 9.8
Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
- Product
- Baijiacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022jizhicms v2.3.1 has SQL injection in the background.CVE-2022-36578 · Other software · Jizhicms · reported by MITRECritical 9.8
jizhicms v2.3.1 has SQL injection in the background.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022An issue was discovered in jizhicms v2.3.1.CVE-2022-36577 · Other software · Jizhicms · reported by MITREHigh 8.8
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-36224 · Other software · Xunruicms · reported by MITREHigh 8.8
XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.CVE-2020-19897 · Other software · Wuzhicms · reported by MITREMedium 6.1
A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.CVE-2020-19896 · Other software · 1234n · reported by MITRECritical 9.8
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.CVE-2022-33121 · Other software · 1234n · reported by MITREHigh 8.1
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/paCVE-2021-41654 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.CVE-2021-41663 · Other software · 1234n · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.CVE-2021-41756 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.CVE-2021-41755 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.CVE-2021-41754 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.CVE-2022-31393 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.CVE-2022-31390 · Other software · Jizhicms · reported by MITRECritical 9.1
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in CCVE-2022-27656 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP NetWeaver AS for ABAP and Java (ICM Administration UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 3, 2022Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.CVE-2022-27431 · Other software · Wuzhicms · reported by MITRECritical 9.8
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.CVE-2022-27429 · Other software · Jizhicms · reported by MITRECritical 9.8
Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.CVE-2021-43100 · Other software · Diyhi · reported by MITREHigh 7.2
A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.CVE-2022-23882 · Other software · Tuzicms · reported by MITRECritical 9.8
TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.CVE-2022-26301 · Other software · Yejiao · reported by MITRECritical 9.8
TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or CVE-2022-0742 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comCritical 9.1
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgsecurity.netapp.com
Feb 24, 2022Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectorCVE-2022-24435 · Other software · Dojin Club MICMNIS · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- Product
- phpUploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecifiCVE-2022-23986 · Other software · Dojin Club MICMNIS · reported by vultures@jpcert.or.jpHigh 7.5
SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors.
- Product
- phpUploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quCVE-2021-20322 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.4
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Feb 10, 2022MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.CVE-2021-44970 · Other software · 1234n · reported by MITREMedium 5.4
MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.CVE-2021-44978 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgem-love.comicmsdev.com
Feb 4, 2022In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.CVE-2021-44977 · Other software · Idreamsoft · reported by MITREHigh 7.5
In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgem-love.comgem-love.com
Jan 27, 2022Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c.CVE-2021-46491 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a userCVE-2020-21236 · Other software · Damicms · reported by MITREHigh 8.8
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
- Product
- Damicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.CVE-2020-19770 · Other software · Wuzhicms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2021SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.CVE-2021-44349 · Other software · Yejiao · reported by MITRECritical 9.8
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2021SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.CVE-2021-44348 · Other software · Yejiao · reported by MITRECritical 9.8
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2021SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.CVE-2021-44347 · Other software · Yejiao · reported by MITRECritical 9.8
SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.CVE-2020-21141 · Other software · Idreamsoft · reported by MITREHigh 8.8
iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2021A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.CVE-2020-28702 · Other software · Pybbs Project · reported by MITREHigh 7.5
A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.
- Product
- Pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2021Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remoteCVE-2021-40114 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
- Product
- Cisco Firepower Threat Defense Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtools.cisco.com
Oct 12, 2021SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functiCVE-2021-40496 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Oct 12, 2021Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitivCVE-2020-28145 · Other software · Wuzhicms · reported by MITREHigh 7.5
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administratCVE-2020-21228 · Other software · Jizhicms · reported by MITREMedium 6.1
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.CVE-2020-20124 · Other software · Wuzhicms · reported by MITREHigh 8.8
Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.