Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Apr 15, 2024Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payloCVE-2020-22540 · Other software · Codologic · reported by MITREMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 15, 2024An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2020-22539 · Other software · codoforum · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 7, 2022Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.CVE-2022-31854 · Other software · Codologic · reported by MITREHigh 7.2
Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcodoforum.com
Jul 9, 2021A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scriCVE-2020-25879 · Other software · Codologic · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Username' parameter.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodoforum.comgithub.com
Jul 9, 2021A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or CVE-2020-25876 · Other software · Codologic · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Page Title' parameter.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodoforum.comgithub.com
Jul 9, 2021A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts oCVE-2020-25875 · Other software · Codologic · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Smiley Code' parameter.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodoforum.comgithub.com
May 12, 2021A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass thCVE-2020-13873 · Other software · Codologic · reported by MITRECritical 9.8
A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.)
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comblog.sonarsource.com
Sep 14, 2020Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'CVE-2020-21845 · Other software · Codoforum · reported by MITREMedium 6.1
Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodoforum.comvyshnavvizz.blogspot.com
Feb 16, 2020Codoforum 4.8.8 allows self-XSS via the title of a new topic.CVE-2020-9007 · Other software · Codologic · reported by MITREMedium 5.4
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2020Codologic Codoforum through 4.8.4 allows a DOM-based XSS.CVE-2020-7050 · Other software · Codologic · reported by MITREMedium 5.4
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comlinkedin.com
Feb 13, 2020Codologic Codoforum through 4.8.4 allows stored XSS in the login area.CVE-2020-7051 · Other software · Codologic · reported by MITREMedium 6.1
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comlinkedin.com
Jan 7, 2020Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI.CVE-2020-5842 · Other software · Codologic · reported by MITREMedium 6.1
Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexploit-db.com
Jan 7, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.CVE-2020-5843 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Jan 5, 2020Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.CVE-2020-5306 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Jan 5, 2020Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.CVE-2020-5305 · Other software · Codologic · reported by MITREMedium 4.8
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodologic.comvyshnavvizz.blogspot.com
Mar 23, 2015The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrarCVE-2014-9261 · Other software · Codologic · reported by MITREMedium 5
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.
- Product
- Codoforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.