Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 28, 2026Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filenamCVE-2026-118485 · Other software · Axel Download Accelerator · reported by 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fdHigh 7
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
- Product
- Axel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.orangecyberdefense.comgithub.com
Jul 16, 2026Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privilegesCVE-2026-63085 · Other software · axelor · reported by VulnCheckHigh 8.7
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such as roles and group by submitting changes through a related entity's save path, bypassing the USER_RESTRICTED_FIELDS control and causing the JPA persistence layer to flush attacker-supplied admin role and group assignments on commit.
- Product
- axelor-open-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cCVE-2025-63223 · Other software · Axeltechnology · reported by MITRECritical 9.8
The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
- Product
- Streamermax MK II Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaxeltechnology.com
Nov 19, 2025The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgCVE-2025-63221 · Other software · Axeltechnology · reported by MITRECritical 9.1
The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
- Product
- Puma Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaxeltechnology.com
Nov 19, 2025The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the CVE-2025-63218 · Other software · Axeltechnology · reported by MITRECritical 9.8
The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
- Product
- Wolf1ms Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaxeltechnology.com
Aug 4, 2025A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter.CVE-2025-50341 · Other software · reported by MITRECritical 9.8
A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determine true/false conditions, potentially leading to data exposure or further exploitation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.CVE-2022-25138 · Other software · Axelor · reported by MITREMedium 5.4
Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.
- Product
- Open Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.axelor.comgithub.com
May 26, 2020An issue was discovered in ssl.c in Axel before 2.17.8.CVE-2020-13614 · Other software · Axel Project · reported by MITREMedium 5.9
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
- Product
- Axel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 13, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12323 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console.
- Product
- Momentum Axel 720p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12261 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12260 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.7
An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12259 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system compromise.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12258 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12257 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2018Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.CVE-2018-10328 · Other software · Momentum · reported by MITREHigh 7.4
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2013Cross-site scripting (XSS) vulnerability in the Javascript and CSS Optimizer extension before 1.1.14 for TYPO3 allows remote attackers to inject arbitrary web sCVE-2013-5570 · Other software · Axel Jung · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Javascript and CSS Optimizer extension before 1.1.14 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- JS CSS Optimizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2009SQL injection vulnerability in the Tech Articles (com_tech_article) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the CVE-2008-6050 · Other software · Ircmaxell · reported by MITREHigh 7.5
SQL injection vulnerability in the Tech Articles (com_tech_article) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the item parameter to index.php.
- Product
- Tech Article
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
May 2, 2005Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.CVE-2005-0390 · Other software · Axel · reported by security@debian.orgHigh 7.5
Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.
- Product
- Axel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurity.gentoo.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.