Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Nov 17, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44001 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44006 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function permits writing files outside the intended target location. Achieving remote code execution is possible, e.g., by uploading an executable file.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44005 · Other software · Backclick · reported by MITREMedium 5.3
An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumeration of subscribers' e-mail addresses. Furthermore, it is possible to subscribe and verify other persons' e-mail addresses to newsletters without their consent.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44004 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44003 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection at various locations.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44002 · Other software · Backclick · reported by MITREMedium 6.1
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross-site scripting (XSS) at various locations.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44000 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44008 · Other software · Backclick · reported by MITREMedium 6.5
An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat server directly.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44007 · Other software · Backclick · reported by MITREHigh 8.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-43999 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server.
- Product
- Backclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.