Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jul 24, 2026An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10CVE-2026-24727 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd.CVE-2026-13724 · Other software · Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trMedium 4.3
Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation. This issue affects Corporate Training Management System: before dd1a9df64.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.CVE-2025-54946 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary CVE-2025-54945 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 10
An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write maCVE-2025-54944 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiMedium 6.9
An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deCVE-2025-54943 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deploCVE-2025-54942 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authCVE-2024-11984 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.4
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.