Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
922 results · page 8 of 19
Mar 18, 2025An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.CVE-2024-41975 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.3
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
- Product
- CODESYS Edge Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet.CVE-2025-1434 · Other software · AREAL SAS · reported by info@cert.vde.comMedium 6.1
The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.
- Product
- Topkapi Vision Webserv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordareal-topkapi.comareal-topkapi.com
Mar 6, 2025Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permiCVE-2025-2045 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Mar 4, 2025Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to prCVE-2021-41719 · Other software · reported by MITREHigh 7.5
Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a cCVE-2025-25329 · Other software · reported by MITREMedium 5.5
An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplyCVE-2025-25326 · Other software · reported by MITREMedium 5.5
An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2024-13155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widget: Transparent Split Hero must be deleted and reinstalled manually.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 1.5.140
- What to do
- Affects up to 1.5.140. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordunlimited-elements.comwordpress.org
Feb 19, 2025An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for MacCVE-2025-1223 · Network & remote access · Citrix · reported by secure@citrix.comMedium 5.9
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
- Product
- Secure Access Client for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for MacCVE-2025-1222 · Network & remote access · Citrix · reported by secure@citrix.comMedium 5.9
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
- Product
- Secure Access Client for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execuCVE-2024-55460 · Other software · reported by MITRECritical 9.8
A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execute arbitrary code via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsgsrs.boardroomlimited.com
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Cross-Site Request ForgeryCVE-2024-13555 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 17, 2025ProfileGrid – User Profiles, Groups and Communities: Limited Server-Side Request ForgeryCVE-2024-13741 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pm_upload_image function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to download and view images, as well as validating if a non-image file exists, both on local or remote hosts.
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.4.2
- What to do
- Affects up to 5.9.4.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2025Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unCVE-2025-0516 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Feb 6, 2025The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and CVE-2025-23094 · Other software · reported by MITREHigh 7.3
The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the same privilege level as the web access process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to cCVE-2025-23093 · Other software · reported by MITREHigh 8.8
The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical.CVE-2025-1078 · Other software · AppHouseKitchen · reported by VulDBMedium 4.8
A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper of the component XPC Service. The manipulation leads to improper authorization. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.30 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional.
- Product
- AlDente Charge Limiter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-24845 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpMedium 5.5
Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 3, 2025The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) tCVE-2024-36437 · Other software · reported by MITREMedium 6.5
The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Feb 3, 2025Unlimited Page Sidebars: Cross-Site Request Forgery (CSRF)CVE-2025-22688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.
- Product
- Unlimited Page Sidebars
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Unlimited Page Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Drag and Drop Multiple File Upload – Contact Form 7: Limited arbitrary file deletionCVE-2024-12267 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
- Product
- Drag and Drop Multiple File Upload – Contact Form 7
- Affected
- up to 1.3.8.5
- What to do
- Affects up to 1.3.8.5. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2025MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution: Limited Local File InclusionCVE-2025-0493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included
- Product
- MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution
- Affected
- up to 4.2.14
- What to do
- Affects up to 4.2.14. Update MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025Users can consume unlimited disk space in /var/crashCVE-2022-28653 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.5
Users can consume unlimited disk space in /var/crash
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker CVE-2025-0065 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.
- Product
- Remote Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted liCVE-2024-56957 · Other software · reported by MITREMedium 6.5
An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.CVE-2024-56955 · Other software · reported by MITREMedium 6.5
An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Social Share, Social Login and Social Comments Plugin – Super Socializer: Limited SQL InjectionCVE-2024-13230 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.14
- What to do
- Affects up to 7.14. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Limited file uploadsCVE-2024-13355 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file type validation in the upload_file() function in all versions up to, and including, 13.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files on the affected site's server which may make remote code execution possible and is confirmed to make Cross-Site Scripting possible.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 13.2
- What to do
- Affects up to 13.2. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Multi Step Form: Unauthorized limited file uploadCVE-2024-12427 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.
- Product
- Multi Step Form
- Affected
- up to 1.7.23
- What to do
- Affects up to 1.7.23. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2025Unlimited Theme Addon For Elementor and WooCommerce: Information ExposureCVE-2024-12116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'uta-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
- Product
- Unlimited Theme Addon For Elementor and WooCommerce
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Unlimited Theme Addon For Elementor and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 9, 2025WP Database Backup – Unlimited Database & Files Backup by Backup for WP: Sensitive Information ExposureCVE-2024-12330 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
- Product
- WP Database Backup – Unlimited Database & Files Backup by Backup for WP
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2024-13153 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widgets: Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel, must be deleted and reinstalled manually.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 1.5.135
- What to do
- Affects up to 1.5.135. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordunlimited-elements.comwordpress.org
Dec 31, 2024Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests CVE-2024-53647 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
- Product
- Trend Micro ID Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.com
Dec 24, 2024Text Prompter – Unlimited chatgpt text prompts for openai tasks: Stored Cross-Site ScriptingCVE-2024-11896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Text Prompter – Unlimited chatgpt text prompts for openai tasks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'text_prompter' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Text Prompter – Unlimited chatgpt text prompts for openai tasks
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Text Prompter – Unlimited chatgpt text prompts for openai tasks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability.CVE-2024-51532 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.
- Product
- PowerStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of servCVE-2024-56319 · Other software · Matter · reported by MITREHigh 7.5
In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service (resource exhaustion).
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Stored Cross-Site ScriptingCVE-2024-10784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 1.5.126
- What to do
- Affects up to 1.5.126. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024The Grid Plus – Unlimited grid layout: Arbitrary shortcode executionCVE-2024-10910 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Grid Plus – Unlimited grid layout
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update The Grid Plus – Unlimited grid layout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 10, 2024Mitel MiCollab Path Traversal VulnerabilityCVE-2024-55550 · Email & office · Mitel · reported by MITREExploitedRansomwareLow 2.7
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmitel.commitel.com
Dec 4, 2024Classic Addons – WPBakery Page Builder: Limited Local PHP File InclusionCVE-2024-11952 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability is limited to PHP files in a Windows environment.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 20, 2024Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter.CVE-2024-52796 · Other software · pglombardo · reported by GitHubMedium 5.3
Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. In v1.49.0, a fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.
- Product
- PasswordPusher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pwpush.comgithub.com
Nov 18, 2024Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains uneCVE-2024-42392 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 4
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comcert-portal.siemens.com
Nov 18, 2024Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate cCVE-2024-42385 · Other software · Cesanta · reported by prodsec@nozominetworks.comMedium 4
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comcert-portal.siemens.com
Nov 18, 2024A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-41968 · Other software · WAGO · reported by info@cert.vde.comMedium 5.4
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbitCVE-2024-46963 · Computers, phones & browsers · google · reported by MITREHigh 8.1
The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component.
- Product
- android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Oct 24, 2024A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all preCVE-2024-48142 · Other software · butterflyeffectpte · reported by MITREHigh 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfCVE-2024-48140 · Other software · butterflyeffectpte · reported by MITREHigh 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromewebstore.google.comgithub.com
Oct 21, 2024A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attackCVE-2024-47224 · Email & office · Mitel · reported by MITREMedium 6.5
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0CVE-2024-41714 · Email & office · mitel · reported by MITREHigh 8.8
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Mitel MiCollab Path Traversal VulnerabilityCVE-2024-41713 · Email & office · Mitel · reported by MITREExploitedRansomwareCritical 9.1
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmitel.comcisa.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.