Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Sep 15, 2026The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.CVE-2026-51134 · Other software · reported by MITREHigh 7.5
The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalbcyberguards.comc-mor.com
Sep 15, 2026Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size paramCVE-2026-51133 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalbcyberguards.comc-mor.com
Oct 9, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45179 · Other software · za-internet · reported by MITREHigh 7.2
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45176 · Other software · C-mor · reported by MITREMedium 6.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting (XSS) attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to insufficient user input validation.
- Product
- C-mor Video Surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45175 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a path traversal attack, has access to the login data of all configured cameras, or the configured FTP server.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45171 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup files allows an authenticated user to upload arbitrary files. The only condition is that the filename contains a .cbkf string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are stored within the directory "/srv/www/backups" on the C-MOR system, and can thus be accessed via the URL https://<HOST>/backup/upload_<FILENAME>. Due to broken access control, low-privileged authenticated users can also use this file upload functionality.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45178 · Other software · za-internet · reported by MITREHigh 7.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45173 · Other software · za-internet · reported by MITREHigh 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45172 · Other software · za-internet · reported by MITREMedium 6.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerable to cross-site request forgery (CSRF) attacks. The C-MOR web interface offers no protection against cross-site request forgery (CSRF) attacks.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45177 · Other software · za-internet · reported by MITREMedium 5.4
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting (XSS) attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site scripting attack due to insufficient user input validation.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.CVE-2024-45174 · Other software · za-internet · reported by MITREHigh 8.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrary SQL commands in the context of the corresponding MySQL database.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.CVE-2024-45170 · Other software · za-internet · reported by MITREHigh 8.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, access those functions is restricted via the web application user interface and not checked on the server side. Thus, by sending corresponding HTTP requests to the web server of the C-MOR web interface, low privileged users can also use administrative functionality, for instance downloading backup files or changing configuration settings.
- Product
- c-mor_video_surveillance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-syss-de.translate.googsyss.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.