Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Aug 12, 2026In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request ForgCVE-2026-49262 · Other software · aimeos · reported by GitHubLow 3
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.
- Product
- pagible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries.CVE-2021-47763 · Websites & servers · Aimeos · reported by VulnCheckHigh 8.8
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
- Product
- Aimeos Laravel ecommerce platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components.CVE-2025-66468 · Other software · aimeos · reported by GitHubHigh 7.6
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
- Product
- ai-cms-grapesjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Aimeos is an e-commerce framework.CVE-2024-47173 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.
- Product
- ai-admin-graphql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects.CVE-2024-39319 · Other software · aimeos · reported by GitHubMedium 5.3
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Product
- ai-controller-frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024aimeos/ai-controller-frontend is the Aimeos frontend controller.CVE-2024-39325 · Other software · aimeos · reported by GitHubMedium 5.3
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Product
- ai-controller-frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface.CVE-2024-39324 · Other software · aimeos · reported by GitHubLow 3.8
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.
- Product
- ai-admin-graphql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks.CVE-2024-39322 · Other software · aimeos · reported by GitHubMedium 5.5
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Product
- ai-admin-jsonadm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface.CVE-2024-39323 · Other software · aimeos · reported by GitHubHigh 7.1
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
- Product
- ai-admin-graphql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024ai-client-html is an Aimeos e-commerce HTML client component.CVE-2024-38516 · Other software · aimeos · reported by GitHubHigh 8.8
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
- Product
- ai-client-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024The Aimeos HTML client provides Aimeos HTML components for e-commerce projects.CVE-2024-37296 · Other software · aimeos · reported by GitHubMedium 5.3
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Product
- ai-client-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37295 · Other software · aimeos · reported by GitHubHigh 7.2
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37294 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2021The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.CVE-2021-28380 · Other software · Aimeos Project · reported by MITREMedium 5.4
The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.
- Product
- Aimeos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.