Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
37 results
Feb 3, 2025Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function.CVE-2024-57498 · Other software · Forestblog Project · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 8, 2023OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.CVE-2021-27280 · Other software · Mblog Project · reported by MITREHigh 7.8
OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclassCVE-2023-27847 · Other software · Xipblog Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
- Product
- Xipblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
Mar 13, 2023Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.CVE-2023-27093 · Other software · My-blog Project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.
- Product
- My-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile.CVE-2022-40037 · Other software · Javaweb Blog Project · reported by MITRECritical 9.8
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile.
- Product
- Javaweb Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter.CVE-2022-40034 · Other software · Javaweb Blog Project · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter.
- Product
- Javaweb Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2022The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_contenCVE-2022-36433 · Other software · Amasty · reported by MITREMedium 6.1
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.
- Product
- Amasty Blog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function.CVE-2022-35501 · Websites & servers · reported by MITREMedium 5.4
Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.CVE-2022-35500 · Other software · Amasty · reported by MITREMedium 5.4
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
- Product
- Blog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely.CVE-2022-36432 · Other software · Amasty · reported by MITREMedium 5.4
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response.
- Product
- Blog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).CVE-2022-30517 · Other software · Mogublog Project · reported by MITREMedium 6.1
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
- Product
- Mogublog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.CVE-2022-29659 · Other software · Responsive Online Blog Project · reported by MITRECritical 9.8
Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.
- Product
- Responsive Online Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourcecodester.com
May 23, 2022The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability.CVE-2021-42233 · Other software · Simple Blog Project · reported by MITREMedium 5.4
The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.
- Product
- Simple Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Apr 15, 2022ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.CVE-2022-29020 · Other software · Forestblog Project · reported by MITREMedium 6.1
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022OneBlog <= 2.2.8 is vulnerable to Insecure Permissions.CVE-2021-46085 · Other software · Oneblog Project · reported by MITREMedium 6.5
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.
- Product
- Oneblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.CVE-2021-46034 · Other software · Forestblog Project · reported by MITREMedium 6.1
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022In ForestBlog, as of 2021-12-28, File upload can bypass verification.CVE-2021-46033 · Other software · Forestblog Project · reported by MITRECritical 9.8
In ForestBlog, as of 2021-12-28, File upload can bypass verification.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management.CVE-2021-46028 · Other software · Mblog Project · reported by MITREMedium 4.3
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8.CVE-2021-46025 · Other software · Oneblog Project · reported by MITREMedium 5.4
A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.
- Product
- Oneblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php.CVE-2021-43682 · Other software · Thinkphp-bjyblog Project · reported by MITREMedium 6.1
thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST'].
- Product
- Thinkphp-bjyblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privCVE-2020-18964 · Other software · Forestblog Project · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges.
- Product
- Forestblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.CVE-2020-19619 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.CVE-2020-19618 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.CVE-2020-19617 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.CVE-2020-19616 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2021Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.CVE-2020-21180 · Other software · Koa2-blog Project · reported by MITRECritical 9.8
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
- Product
- Koa2-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2021Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.CVE-2020-21179 · Other software · Koa2-blog Project · reported by MITRECritical 9.8
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.
- Product
- Koa2-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2019laravel-bjyblog 6.1.1 has XSS via a crafted URL.CVE-2019-17494 · Other software · Laravel-bjyblog Project · reported by MITREMedium 6.1
laravel-bjyblog 6.1.1 has XSS via a crafted URL.
- Product
- Laravel-bjyblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2019madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk iCVE-2019-9842 · Other software · Miniblog Project · reported by MITREHigh 7.2
madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension.
- Product
- Miniblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrastating.github.io
Jan 1, 2019Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter.CVE-2019-3494 · Other software · Simply-blog Project · reported by MITREHigh 7.5
Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter.
- Product
- Simply-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2018SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.CVE-2018-17391 · Other software · Super CMS Blog Pro Project · reported by MITRECritical 9.8
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
- Product
- Super CMS Blog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 10, 2018Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.CVE-2018-16780 · Other software · Complete Responsive CMS Blog Project · reported by MITREMedium 5.4
Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.
- Product
- Complete Responsive CMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2017SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php.CVE-2017-15539 · Other software · Zorovavi/blog Project · reported by MITRECritical 9.8
SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php.
- Product
- Zorovavi/blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2017upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/CVE-2017-14346 · Other software · Blog Project · reported by MITRECritical 9.8
upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2017SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.CVE-2017-14345 · Other software · Blog Project · reported by MITRECritical 9.8
SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2015Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.CVE-2015-0905 · Other software · Bblog Project · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.
- Product
- Bblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2006Cross-site scripting (XSS) vulnerability in img.php in (1) EasyMoblog 0.5.1 and (2) CoMoblog 1.1 allows remote attackers to inject arbitrary web script or HTML CVE-2006-1377 · Other software · Comoblog Project · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in img.php in (1) EasyMoblog 0.5.1 and (2) CoMoblog 1.1 allows remote attackers to inject arbitrary web script or HTML via the i parameter.
- Product
- Comoblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.