Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jun 26, 2023An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote atCVE-2023-33404 · Other software · Blogengine · reported by MITRECritical 9.8
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2023Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.CVE-2023-33405 · Other software · Blogengine · reported by MITREMedium 6.1
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.CVE-2023-22858 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auMedium 5.3
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Mar 6, 2023A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor CVE-2023-22857 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auHigh 8.5
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Mar 6, 2023A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor CVE-2023-22856 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auHigh 8.5
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Jan 18, 2023BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.CVE-2022-41417 · Other software · Blogengine · reported by MITRECritical 9.8
BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 19, 2022An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via upCVE-2022-41418 · Other software · Blogengine · reported by MITREHigh 7.2
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 2, 2022BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts.CVE-2022-36600 · Other software · Blogengine · reported by MITREMedium 4.8
BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting CVE-2022-28921 · Other software · Blogengine · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogengine.io0xlanks.me
May 13, 2022BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root dirCVE-2022-25591 · Other software · Blogengine · reported by MITRECritical 9.1
BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogengine.io0xlanks.me
Jul 3, 2019BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, loginCVE-2019-10721 · Other software · Dotnetblogengine · reported by MITREMedium 6.1
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritymetrics.com
Jul 3, 2019BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.CVE-2019-10717 · Other software · Dotnetblogengine · reported by MITREHigh 7.1
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jun 21, 2019BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.CVE-2019-11392 · Other software · Dotnetblogengine · reported by MITREHigh 7.5
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritymetrics.comsecuritymetrics.com
Jun 21, 2019BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager.CVE-2019-10720 · Other software · Blogengine · reported by MITREHigh 8.8
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 21, 2019BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngiCVE-2019-10719 · Other software · Dotnetblogengine · reported by MITREHigh 8.8
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 21, 2019BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.CVE-2019-10718 · Other software · Dotnetblogengine · reported by MITREHigh 7.5
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecuritymetrics.com
May 7, 2019BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.CVE-2018-14485 · Other software · Blogengine · reported by MITRECritical 9.8
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 21, 2019An issue was discovered in BlogEngine.NET through 3.3.6.0.CVE-2019-6714 · Other software · Blogengine · reported by MITRECritical 9.8
An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 3, 2014BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.CVE-2013-6953 · Other software · Dotnetblogengine · reported by cret@cert.orgMedium 5
BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Mar 16, 2009Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameteCVE-2008-6476 · Other software · Dotnetblogengine · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter.
- Product
- Blogengine.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.