Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

404 results · page 8 of 9

Feb 25, 2019tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass througCVE-2018-20790 · Other software · Tecrail · reported by MITREHigh 7.5
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 25, 2019tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass tCVE-2018-20789 · Other software · Tecrail · reported by MITREHigh 7.5
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 16, 2019PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar.CVE-2019-8361 · Other software · Responsive Video News Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
Product
Responsive Video News Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackingvila.wordpress.com hackingvila.wordpress.com
Oct 31, 2018An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter.CVE-2018-18867 · Other software · Tecrail · reported by MITREHigh 8.6
An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 10, 2018An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1.CVE-2018-18062 · Other software · Tecrail · reported by MITREMedium 6.1
An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web script or HTML.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Oct 10, 2018An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1.CVE-2018-18061 · Other software · Tecrail · reported by MITREHigh 7.5
An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the ability to upload and delete files.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 10, 2018Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.CVE-2018-16780 · Other software · Complete Responsive CMS Blog Project · reported by MITREMedium 5.4
Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.
Product
Complete Responsive CMS Blog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 24, 2018/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crCVE-2018-15536 · Other software · Tecrail · reported by MITREMedium 5.5
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org exploit-db.com
Aug 24, 2018/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted direcCVE-2018-15535 · Other software · Tecrail · reported by MITREHigh 7.5
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org exploit-db.com
Aug 17, 2018/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec caCVE-2018-15495 · Other software · Tecrail · reported by MITREHigh 7.5
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Aug 3, 2018upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.CVE-2018-14728 · Other software · Tecrail · reported by MITRECritical 9.8
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
Product
Responsive Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jun 11, 2018If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operCVE-2017-5419 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. This vulnerability affects Firefox < 52 and Thunderbird < 52.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
May 9, 2018modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows rCVE-2018-8824 · Other software · Responsive Mega Menu Pro Project · reported by MITRECritical 9.8
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter.
Product
Responsive Mega Menu Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ia-informatica.com ia-informatica.com
Apr 23, 2018The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.CVE-2018-10309 · WordPress plugins & themes · reported by MITREMedium 5.4
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
Product
Responsive Cookie Consent
Fixed in
1.8
What to do
Update Responsive Cookie Consent to 1.8 or newer.
Full record and what to do →NVD record gist.github.com wordpress.org
Mar 27, 2018modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows rCVE-2018-8823 · Other software · Responsive Mega Menu Pro Project · reported by MITRECritical 9.8
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.
Product
Responsive Mega Menu Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ia-informatica.com ia-informatica.com
Mar 14, 2018the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL InjCVE-2018-1000131 · WordPress plugins & themes · reported by MITRECritical 9.8
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Product
the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter
Affected
up to 9.0.2
Fixed in
9.0.3
What to do
Update the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter to 9.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Feb 17, 2018SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.CVE-2018-6583 · Other software · Quanticalabs · reported by MITRECritical 9.8
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
Product
Timetable Responsive Schedule
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.CVE-2018-6864 · Other software · Multireligion Responsive Matrimonial Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.
Product
Multireligion Responsive Matrimonial
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 24, 2018SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.CVE-2018-5979 · Other software · Wchat Project · reported by MITRECritical 9.8
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
Product
Wchat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jan 16, 2018ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP packets.CVE-2018-5330 · Network & remote access · Zyxel · reported by MITREHigh 7.5
ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP packets.
Product
P-660hw V3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5666 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5665 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5664 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5663 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5662 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5661 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5660 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5659 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5658 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 12, 2018An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress.CVE-2018-5657 · WordPress plugins & themes · reported by MITREMedium 4.8
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.
Product
responsive-coming-soon-page
Affected
1.1.18 to 1.1.18
What to do
Affects 1.1.18 to 1.1.18. Update responsive-coming-soon-page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpvulndb.com
Jan 9, 2018The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.CVE-2018-5312 · WordPress plugins & themes · reported by MITREMedium 5.4
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
Affected
1.8.0 to 1.8.0
What to do
Affects 1.8.0 to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.CVE-2017-17909 · Other software · Responsive Realestate Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
Product
Responsive Realestate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.CVE-2017-17908 · Other software · Responsive Realestate Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
Product
Responsive Realestate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 13, 2017Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.CVE-2017-17632 · Other software · Responsive Events And Movie Ticket Booking Script Project · reported by MITRECritical 9.8
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
Product
Responsive Events And Movie Ticket Booking Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.CVE-2017-17631 · Other software · Multireligion Responsive Matrimonial Project · reported by MITRECritical 9.8
Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.
Product
Multireligion Responsive Matrimonial
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Dec 13, 2017Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.CVE-2017-17628 · Other software · Responsive Realestate Script Project · reported by MITRECritical 9.8
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
Product
Responsive Realestate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Nov 17, 2017Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin canCVE-2017-1000227 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
Affected
3.0.15 to 3.0.15
What to do
Affects 3.0.15 to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record security.dxw.com wpvulndb.com
Oct 31, 2017Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.CVE-2017-15981 · Other software · Geniusocean · reported by MITRECritical 9.8
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Product
Newspaper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 27, 2017A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, viaCVE-2017-14182 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.5
A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API.
Product
Fortinet FortiOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code610.blogspot.com securityfocus.com
Sep 25, 2017SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the CVE-2017-14125 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.
Product
SQL injection vulnerability in the Responsive Image Gallery
Fixed in
1.2.1
What to do
Update SQL injection vulnerability in the Responsive Image Gallery to 1.2.1 or newer.
Full record and what to do →NVD record seclists.org wpvulndb.com
Sep 14, 2017Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responCVE-2017-1002027 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · WordPress plugins & themes · reported by MITREHigh 7.2
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
Product
Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery
Fixed in
1.3.51
What to do
Update Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery to 1.3.51 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2017Responsive Lightbox prior to version 1.7.2: Cross-site scriptingCVE-2017-2243 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Product
Responsive Lightbox prior to version 1.7.2
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Responsive Lightbox prior to version 1.7.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbiCVE-2014-4594 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Product
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview
Fixed in
1.2
What to do
Update Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview to 1.2 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org
Mar 14, 2014the Responsive Logo Slideshow plugin for: Cross-site scripting (XSS)CVE-2013-1759 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.
Product
the Responsive Logo Slideshow plugin for
What to do
Update the Responsive Logo Slideshow plugin for to the newest version.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Nov 23, 2013ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-ClCVE-2010-3443 · Other software · Quassel-irc · reported by Red HatMedium 5
ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.
Product
Quassel IRC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.quassel-irc.org bugs.quassel-irc.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users withCVE-2013-1785 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer thCVE-2013-1782 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Product
Responsive Blog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer thCVE-2013-1780 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Product
Best Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Aug 14, 2008sockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote attackers to cause a denial of service (hang) by connecting to a non-responsive server, whicCVE-2008-3688 · Other software · Havp · reported by MITREHigh 7.5
sockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote attackers to cause a denial of service (hang) by connecting to a non-responsive server, which triggers an infinite loop due to an uninitialized variable.
Product
Http Antivirus Proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.