Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
43 results
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injectiCVE-2019-25494 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'valCVE-2019-25493 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter. Attackers can send GET requests to the admin/getrecord.php endpoint with malicious 'val' values to extract sensitive database information.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt'CVE-2019-25492 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter. Attackers can send GET requests to the admin/getcmsdata.php endpoint with malicious 'pt' values to extract sensitive database information.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catiCVE-2019-25491 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive database information.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' CVE-2019-25490 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 27, 2026Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hostiCVE-2019-25489 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service.
- Product
- Homey BNB (Airbnb Clone Script)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoditsolutions.comexploit-db.com
Feb 20, 2026Fiverr Clone Script 1.2.2 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the keCVE-2019-25445 · Websites & servers · Phpscriptsmall · reported by VulnCheckMedium 5.1
Fiverr Clone Script 1.2.2 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft URLs with script tags in the keyword parameter of search-results.php to execute arbitrary JavaScript in users' browsers.
- Product
- Fiverr Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Feb 20, 2026Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thrCVE-2019-25444 · Websites & servers · Phpscriptsmall · reported by VulnCheckHigh 8.8
Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can supply malicious SQL syntax in the page parameter to extract sensitive database information or modify database contents.
- Product
- Fiverr Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jan 12, 2019PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php.CVE-2019-6248 · Other software · Citysearch / Hotfrog / Gelbeseiten Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php.
- Product
- Citysearch / Hotfrog / Gelbeseiten Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Aug 10, 2018PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaSCVE-2018-15185 · Other software · Naukri Clone Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaScript code in the "Current Position" field.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.CVE-2018-15184 · Other software · Naukri Clone Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.CVE-2018-15183 · Other software · Myperfectresume / Jobhero / Resume Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.
- Product
- Myperfectresume / Jobhero / Resume Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2018PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changinCVE-2018-11514 · Other software · Naukri Clone Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitehatck01.blogspot.comwhitehatck01.blogspot.com
Apr 12, 2018PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modiCVE-2018-6903 · Other software · HOT Scripts Clone Project · reported by MITREHigh 8.8
PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code.
- Product
- HOT Scripts Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Apr 9, 2018PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).CVE-2018-9857 · Other software · Match Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
- Product
- Match Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comexploit-db.com
Apr 5, 2018PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.CVE-2018-9328 · Other software · Redbus Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.
- Product
- Redbus Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.CVE-2018-6868 · Other software · Groupon Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
- Product
- Groupon Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.CVE-2018-6867 · Other software · Alibaba Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
- Product
- Alibaba Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgithub.com
Feb 11, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.CVE-2018-6858 · Other software · Facebook Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
- Product
- Facebook Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 11, 2018PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.CVE-2018-6845 · Other software · OLX Clone Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.
- Product
- OLX Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 9, 2018Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field.CVE-2018-6878 · Other software · HOT Scripts Clone Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field.
- Product
- HOT Scripts Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 7, 2018PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.CVE-2018-6795 · Other software · Naukri Clone Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.
- Product
- Naukri Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 27, 2017PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.CVE-2017-17931 · Other software · Resume Clone Script Project · reported by MITRECritical 9.8
PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
- Product
- Resume Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.CVE-2017-17641 · Other software · Resume Clone Script Project · reported by MITRECritical 9.8
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
- Product
- Resume Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.CVE-2017-17638 · Other software · Groupon Clone Script Project · reported by MITRECritical 9.8
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
- Product
- Groupon Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.CVE-2017-17621 · Other software · Multivendor Penny Auction Clone Script Project · reported by MITRECritical 9.8
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
- Product
- Multivendor Penny Auction Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 13, 2017Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.CVE-2017-17618 · Other software · Kickstarter Clone Script Project · reported by MITRECritical 9.8
Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.
- Product
- Kickstarter Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.CVE-2017-17617 · Other software · Foodspotting Clone Script Project · reported by MITRECritical 9.8
Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.
- Product
- Foodspotting Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.CVE-2017-17615 · Other software · Facebook Clone Script Project · reported by MITREHigh 8.8
Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
- Product
- Facebook Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.CVE-2017-17605 · Other software · Consumer Complaints Clone Script Project · reported by MITRECritical 9.8
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
- Product
- Consumer Complaints Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.CVE-2017-17597 · Other software · Nearbuy Clone Script Project · reported by MITRECritical 9.8
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
- Product
- Nearbuy Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 31, 2017Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.CVE-2017-15993 · Other software · Zomato Clone Script Project · reported by MITRECritical 9.8
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
- Product
- Zomato Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 18, 2015Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr oCVE-2015-4658 · Other software · Milw0rm Project · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
- Product
- Milw0rm Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 29, 2015SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.CVE-2015-4137 · Other software · Milw0rm Project · reported by MITREHigh 7.5
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
- Product
- Milw0rm Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 9, 2012Cross-site scripting (XSS) vulnerability in search/ in GraphicsClone Script, possibly 1.11, allows remote attackers to inject arbitrary web script or HTML via tCVE-2011-5209 · Other software · Cloneforest · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search/ in GraphicsClone Script, possibly 1.11, allows remote attackers to inject arbitrary web script or HTML via the term parameter.
- Product
- Graphicsclone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jul 24, 2009Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msCVE-2009-2588 · Other software · Resalecode · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.
- Product
- Hotscripts Type PHP Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2009Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie toCVE-2008-6162 · Other software · BUX · reported by MITREHigh 7.5
Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin.
- Product
- Bux.to Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Feb 11, 2008Cross-site scripting (XSS) vulnerability in siteadmin/editor_files/includes/load_message.php in the Youtube Clone Script allows remote attackers to inject arbitCVE-2008-0687 · Other software · Youtube · reported by MITREHigh 7.5
Cross-site scripting (XSS) vulnerability in siteadmin/editor_files/includes/load_message.php in the Youtube Clone Script allows remote attackers to inject arbitrary web script or HTML via the lang[please_wait] parameter.
- Product
- Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Nov 21, 2007SQL injection vulnerability in software-description.php in HotScripts Clone Script allows remote attackers to execute arbitrary SQL commands via the id parameteCVE-2007-6084 · Other software · Hotscripts · reported by MITREHigh 7.5
SQL injection vulnerability in software-description.php in HotScripts Clone Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Nov 20, 2007PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrarCVE-2007-6057 · Other software · Datecomm · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
- Product
- Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2007SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary SQL commanCVE-2007-5992 · Other software · Datecomm · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewcat s action on the forums page.
- Product
- Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Jul 15, 2007Cross-site request forgery (CSRF) vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrCVE-2007-3773 · Other software · Generic Youtube Clone Script · reported by MITREHigh 9.3
Cross-site request forgery (CSRF) vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators.
- Product
- Generic Youtube Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchxsecurity.orgosvdb.org
Jul 3, 2007SQL injection vulnerability in msg.php in HispaH YouTube Clone Script (youtubeclone) allows remote attackers to execute arbitrary SQL commands via the id parameCVE-2007-3518 · Other software · Hispah · reported by MITREHigh 7.5
SQL injection vulnerability in msg.php in HispaH YouTube Clone Script (youtubeclone) allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Youtube Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.