Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Oct 24, 2026DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign prCVE-2026-116008 · Other software · Bottelet · reported by VulnCheckMedium 5.3
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1.CVE-2026-10283 · Other software · Bottelet · reported by VulDBMedium 5.3
A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1.CVE-2026-10282 · Other software · Bottelet · reported by VulDBMedium 5.3
A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration.CVE-2022-22113 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 8.8
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 13, 2022In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI).CVE-2022-22112 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 5.4
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization.CVE-2022-22111 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 8.8
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality.CVE-2022-22110 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 7.5
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious CVE-2022-22109 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 5.4
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.CVE-2022-22108 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 4.3
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.CVE-2022-22107 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 4.3
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 25, 2020Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.CVE-2020-35707 · Other software · Daybydaycrm · reported by MITREMedium 5.4
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
- Product
- Daybyday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtufangungor.github.io
Dec 25, 2020Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.CVE-2020-35706 · Other software · Daybydaycrm · reported by MITREMedium 5.4
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
- Product
- Daybyday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtufangungor.github.io
Dec 25, 2020Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.CVE-2020-35705 · Other software · Daybydaycrm · reported by MITREMedium 5.4
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
- Product
- Daybyday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtufangungor.github.io
Dec 25, 2020Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.CVE-2020-35704 · Other software · Daybydaycrm · reported by MITREMedium 5.4
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
- Product
- Daybyday
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtufangungor.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.