Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Aug 25, 2026Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files ouCVE-2026-57863 · Other software · crater-invoice-inc · reported by VulnCheckHigh 8.7
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.
- Product
- crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Aug 5, 2026Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and othCVE-2026-71242 · Other software · crater-invoice · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.3
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
- Product
- crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id).CVE-2026-55739 · Other software · crater-invoice · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.3
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
- Product
- Crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2026A weakness has been identified in crater-invoice-inc crater up to 6.0.6.CVE-2026-14791 · Other software · crater-invoice-inc · reported by VulDBLow 2
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulaCVE-2024-55556 · Other software · reported by MITRECritical 9.8
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsynacktiv.com
Aug 12, 2024An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network tCVE-2024-39091 · Other software · annke · reported by MITREHigh 8.8
An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request.
- Product
- crater_2_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoerngermany.github.io
Oct 29, 2023/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an imagCVE-2023-46865 · Other software · Craterapp · reported by MITREHigh 7.2
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
- Product
- Crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-1032 · Other software · crater-invoice · reported by security@huntr.devHigh 7.2
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-1033 · Other software · crater-invoice · reported by security@huntr.devHigh 7.8
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.CVE-2022-0515 · Other software · crater-invoice · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.CVE-2022-0514 · Other software · crater-invoice · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.CVE-2022-0372 · Other software · crater-invoice · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.CVE-2022-0203 · Other software · crater-invoice · reported by security@huntr.devMedium 5.3
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.CVE-2022-0242 · Other software · crater-invoice · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022crater is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-4080 · Other software · crater-invoice · reported by security@huntr.devHigh 8.8
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.