Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

317 results · page 1 of 7

Oct 26, 2026A vulnerability has been identified in BRAIN2 versions up to and including version 3.09.CVE-2026-112250 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6Medium 4.4
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.
Product
BRAIN2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Oct 14, 2026BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that alCVE-2026-110608 · Other software · BizSpring · reported by VulnCheckMedium 5.3
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Product
BizSpring Shop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling CVE-2026-110607 · Other software · BizSpring · reported by VulnCheckHigh 7.1
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
Product
BizSpring Shop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 16, 2026An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe componentCVE-2026-51990 · Other software · reported by MITRECritical 9.8
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sogou.com gendigital.com
Sep 14, 2026Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.CVE-2026-88262 · Other software · bizwell · reported by 09832df1-09c1-45b4-8a85-16c601d30febHigh 8.7
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1.
Product
xClick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizwell.net
Sep 14, 2026Improper input validation vulnerability in bizwell xClick allows Stored XSS.CVE-2026-88261 · Other software · bizwell · reported by 09832df1-09c1-45b4-8a85-16c601d30febMedium 5.1
Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1.
Product
xClick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizwell.net
Sep 7, 2026Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc.CVE-2026-7861 · Other software · Next4Biz Information Technologies Inc. · reported by iletisim@usom.gov.trCritical 9.8
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.
Product
CSM (Customer Service Management)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Sep 7, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc.CVE-2026-6377 · Other software · Next4Biz Information Technologies Inc. · reported by iletisim@usom.gov.trHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal. This issue affects CSM (Customer Service Management): from 6.8.9 before 8.0.3.
Product
CSM (Customer Service Management)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Jul 23, 2026Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc.CVE-2026-8287 · Other software · BizimHesap Information Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trMedium 4.3
Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026.
Product
Online Pre-Accounting Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Jul 20, 2026In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup.CVE-2026-16247 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6High 7.3
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.
Product
_connect.BRAIN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Jul 20, 2026In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup.CVE-2026-16246 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6High 7.3
In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11.
Product
BRAIN2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bizerba.com
Jun 19, 2026Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting maliciouCVE-2019-25759 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database names.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wdmtech.com extensions.joomla.org
Jun 19, 2026Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submittingCVE-2019-25758 · Websites & servers · reported by VulnCheckHigh 8.7
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wdmtech.com extensions.joomla.org
Jun 10, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource ediCVE-2026-50223 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jun 10, 2026A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: CVE-2026-47342 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability CVE-2026-46586 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 2CVE-2026-45434 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authorization vulnerability in Apache OFBiz Webtools.CVE-2026-45187 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.CVE-2026-41919 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.CVE-2026-35086 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.CVE-2026-31986 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.CVE-2026-31910 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.CVE-2026-31909 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.CVE-2026-31906 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.CVE-2026-31388 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authentication vulnerability in Apache OFBiz.CVE-2026-31387 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.CVE-2026-31380 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path TraversCVE-2026-31379 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Input Validation vulnerability in Apache OFBiz.CVE-2026-31378 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.CVE-2026-29226 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.CVE-2026-29220 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.CVE-2026-29207 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Apr 8, 2026BizReview: Missing AuthorizationCVE-2026-39606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizReview: from n/a through <= 1.5.13.
Product
BizReview
Affected
up to 1.5.13
What to do
Affects up to 1.5.13. Update BizReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2026An issue was discovered in Biztalk360 before 11.5.CVE-2025-59711 · Other software · Kovai · reported by MITREHigh 8.3
An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
Product
Biztalk360
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com
Apr 3, 2026An issue was discovered in Biztalk360 before 11.5.CVE-2025-59710 · Other software · Kovai · reported by MITREHigh 8.8
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the server.
Product
Biztalk360
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com
Apr 3, 2026An issue was discovered in Biztalk360 through 11.5.CVE-2025-59709 · Other software · Kovai · reported by MITREMedium 6.8
An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is able to read files on the system and/or coerce an authentication from the service, aka Directory Traversal.
Product
Biztalk360
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com
Mar 26, 2026OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through thCVE-2018-25209 · Other software · Sourceforge · reported by VulnCheckHigh 8.8
OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.
Product
OpenBiz Cubi Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Dec 30, 2025BizPrint: Missing AuthorizationCVE-2025-69024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.
Product
BizPrint
Affected
up to 4.6.7
What to do
Affects up to 4.6.7. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php.CVE-2023-53935 · Other software · Codester · reported by VulnCheckMedium 5.3
WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed requests to the ticket endpoint.
Product
WBiz Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codester.com exploit-db.com
Dec 14, 2025A security vulnerability has been detected in DedeBIZ up to 6.5.9.CVE-2025-14648 · Other software · Dedebiz · reported by VulDBLow 2
A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalog_add.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Product
Dedebiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Dec 10, 2025EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive cCVE-2020-36895 · Other software · EIBIZ Co.,Ltd. · reported by VulnCheckHigh 8.7
EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.
Product
i-Media Server Digital Signage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eibiz.co.th exploit-db.com
Dec 10, 2025Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through ACVE-2020-36894 · Other software · EIBIZ Co.,Ltd. · reported by VulnCheckCritical 9.3
Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative users without authentication, bypassing security controls.
Product
i-Media Server Digital Signage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eibiz.co.th exploit-db.com
Dec 10, 2025Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside theCVE-2020-36893 · Other software · EIBIZ Co.,Ltd. · reported by VulnCheckHigh 8.7
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.
Product
i-Media Server Digital Signage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eibiz.co.th exploit-db.com
Dec 10, 2025Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modiCVE-2020-36892 · Other software · EIBIZ Co.,Ltd. · reported by VulnCheckCritical 9.3
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.
Product
i-Media Server Digital Signage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eibiz.co.th exploit-db.com
Nov 13, 2025ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in theCVE-2022-4984 · Other software · Qingdao Esoft Tianchuang Network Technology Co., Ltd. · reported by VulnCheckHigh 8.7
ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database query. A remote unauthenticated attacker can exploit this issue to execute crafted SQL expressions and retrieve sensitive information from the backend database, including user and application data. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.
Product
ZenTao Biz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cnvd.org.cn vulncheck.com
Nov 12, 2025Reflected cross-site scripting vulnerability in Apache OFBiz.CVE-2025-61623 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Nov 12, 2025Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.CVE-2025-59118 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Nov 9, 2025A security vulnerability has been detected in DedeBIZ up to 6.3.2.CVE-2025-12927 · Other software · Dedebiz · reported by VulDBLow 2
A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipulation of the argument flags[] leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Product
Dedebiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 7, 2025A vulnerability was determined in DedeBIZ up to 6.3.2.CVE-2025-12861 · Other software · Dedebiz · reported by VulDBLow 2
A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipulation of the argument flags[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Product
Dedebiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 7, 2025A vulnerability was found in DedeBIZ up to 6.3.2.CVE-2025-12860 · Other software · Dedebiz · reported by VulDBLow 2
A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderby results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Product
Dedebiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.