Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Jul 14, 2026Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regCVE-2026-15030 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.6
Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
- Product
- System Control Interface v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perfCVE-2026-15029 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.4
Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protections. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
- Product
- System Control Interface v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tamperedCVE-2026-8921 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.5
External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.
- Product
- ASUS Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2026An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager.CVE-2025-13348 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.5
An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user sending a specially crafted request, potentially leading to the creation of arbitrary files in a specified path. Refer to the "Security Update for ASUS Business Manager" section on the ASUS Security Advisory for more information.
- Product
- ASUS Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows SCVE-2024-7085 · Other software · OpenText™ · reported by security@opentext.comHigh 8.2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows Stored XSS. The vulnerability could result in the exposure of private information to an unauthorized actor. This issue affects Solutions Business Manager (SBM): through 12.2.1.
- Product
- Solutions Business Manager (SBM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024Simple Business Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51599 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in russell.albin Simple Business Manager simple-business-manager allows Stored XSS.This issue affects Simple Business Manager: from n/a through <= 4.6.7.4.
- Product
- Simple Business Manager
- Affected
- up to 4.6.7.4
- What to do
- Affects up to 4.6.7.4. Update Simple Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2023An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066.CVE-2023-6098 · Other software · ICSSolution · reported by cve-coordination@incibe.esMedium 6.3
An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obdd_act parameter, allowing the attacker to steal an authenticated user's session, and perform actions within the application.
- Product
- ICS Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089.CVE-2023-6097 · Other software · ICSSolution · reported by cve-coordination@incibe.esCritical 9.4
A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction.
- Product
- ICS Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021Business Manager: Stored Cross-Site ScriptingCVE-2021-39332 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Business Manager
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 25, 2021Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.CVE-2019-18947 · Other software · Micro Focus · reported by security@opentext.comLow 3.5
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 25, 2021Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.CVE-2019-18946 · Other software · Micro Focus · reported by security@opentext.comMedium 4.8
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 25, 2021Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.CVE-2019-18945 · Other software · Micro Focus · reported by security@opentext.comHigh 7.3
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 25, 2021Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.CVE-2019-18944 · Other software · Micro Focus · reported by security@opentext.comMedium 4.9
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 25, 2021Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.CVE-2019-18943 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 25, 2021Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS.CVE-2019-18942 · Other software · Micro Focus · reported by security@opentext.comMedium 5.5
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Jan 2, 2020SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permissiCVE-2013-3932 · Other software · Jomres · reported by PSIRT-CNA@flexerasoftware.comHigh 8.8
SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the id parameter in an editProfile action to administrator/index.php.
- Product
- Jomres component for Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jun 7, 2019Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.CVE-2019-3477 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Mar 27, 2019Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19644 · Other software · Micro Focus · reported by security@opentext.comMedium 5
Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- Solutions Business Manager (SBM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Mar 27, 2019Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19643 · Other software · Micro Focus · reported by security@opentext.comMedium 4.7
Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- Solutions Business Manager (SBM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Mar 27, 2019Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19642 · Other software · Micro Focus · reported by security@opentext.comMedium 5.1
Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- Solutions Business Manager (SBM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Mar 27, 2019Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19641 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- Solutions Business Manager (SBM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Feb 12, 2019An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.CVE-2018-19645 · Other software · NetIQ eDirectory · reported by security@opentext.comCritical 9.8
An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- Product
- NetIQ Access Manager (NAM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Jun 22, 2018Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.CVE-2018-7682 · Other software · Micro Focus · reported by security@opentext.comMedium 6.5
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.
- Product
- Solutions Business Manager 11.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Jun 21, 2018Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.CVE-2018-7683 · Other software · Micro Focus · reported by security@opentext.comHigh 7.5
Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.
- Product
- Solutions Business Manager 11.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Jun 21, 2018Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder.CVE-2018-7681 · Other software · Micro Focus · reported by security@opentext.comMedium 4.8
Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system.
- Product
- Solutions Business Manager 11.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Jun 21, 2018Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.CVE-2018-7680 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.
- Product
- Solutions Business Manager 11.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Jun 21, 2018Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validatCVE-2018-7679 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution.
- Product
- Solutions Business Manager 11.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.serena.comhelp.serena.com
Feb 23, 2009Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modifCVE-2009-0700 · Other software · Plunet · reported by MITREMedium 4
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
- Product
- Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Feb 23, 2009Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users tCVE-2009-0699 · Other software · Plunet · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.
- Product
- Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.