Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 17, 2026Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload aCVE-2026-74845 · Other software · 2100 Technology · reported by twcert@cert.org.twHigh 8.7
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 16, 2026Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with AgentCVE-2026-63082 · Other software · Ultimate Fosters · reported by VulnCheckMedium 5.3
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
- Product
- Perfect Support Ticketing & Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers withCVE-2026-63081 · Other software · Ultimate Fosters · reported by VulnCheckMedium 5.1
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin users, enabling session hijacking or unauthorized actions on behalf of the victim.
- Product
- Perfect Support Ticketing & Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Feb 9, 2026The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized.CVE-2026-24323 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
- Product
- SAP Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated.CVE-2026-0505 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
- Product
- SAP Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify CVE-2026-1514 · Other software · 2100 Technology · reported by twcert@cert.org.twHigh 7.1
Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify front-end code to read all official documents.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 20, 2025Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and exCVE-2025-11948 · Other software · Excellent Infotek · reported by twcert@cert.org.twCritical 9.3
Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 11, 2025Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtainCVE-2025-8853 · Other software · 2100 Technology · reported by twcert@cert.org.twCritical 9.3
Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comchtsecurity.com
May 23, 2025Document Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46448 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System dms allows Reflected XSS.This issue affects Document Management System: from n/a through <= 1.24.
- Product
- Document Management System
- Affected
- up to 1.24
- What to do
- Affects up to 1.24. Update Document Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability.CVE-2024-13061 · Other software · 2100 Technology Electronic · reported by twcert@cert.org.twCritical 9.8
The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comchtsecurity.com
Jul 14, 2024The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regulCVE-2024-6737 · Other software · 2100 TECHNOLOGY · reported by twcert@cert.org.twHigh 8.8
The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.
- Product
- Electronic Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 15, 2024Paperless-ngx is a document management system that transforms physical documents into a searchable online archive.CVE-2024-35184 · Other software · paperless-ngx · reported by GitHubMedium 5.5
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
- Product
- paperless-ngx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document ManagemenCVE-2023-4034 · Other software · Digita Information Technology · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.
- Product
- Smartrise Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 23, 2022The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download.CVE-2022-27192 · Other software · Asseco · reported by MITREHigh 7.5
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.
- Product
- DVS Avilys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlt.asseco.com
Jul 28, 2017MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access.CVE-2017-11694 · Other software · Medhost · reported by MITRECritical 9.1
MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with Apache Solr may be able to obtain or modify sensitive patient and financial information. The Apache Solr account name is dms. The password is hard-coded throughout the application, and is the same across all installations. Customers do not have the option to change passwords. The dms account for Apache Solr has access to all indexed patient documents.
- Product
- Medhost Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jul 28, 2017MEDHOST Document Management System contains hard-coded credentials that are used for customer database access.CVE-2017-11693 · Other software · Medhost · reported by MITRECritical 9.1
MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. PostgreSQL is used as the Document Management System database. The account name is dms. The password is hard-coded throughout the application, and is the same across all installations. Customers do not have the option to change passwords. The dms account for PostgreSQL has access to the database schema for Document Management System.
- Product
- Medhost Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Nov 1, 2011SQL injection vulnerability in detail.php in Simple Document Management System (SDMS) allows remote attackers to execute arbitrary SQL commands via the doc_id pCVE-2010-4986 · Other software · Cafuego · reported by MITREHigh 7.5
SQL injection vulnerability in detail.php in Simple Document Management System (SDMS) allows remote attackers to execute arbitrary SQL commands via the doc_id parameter.
- Product
- Simple Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
May 1, 2009Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQL commands via the (CVE-2009-1503 · Other software · Tigerdms · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
- Product
- Tigerdms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 21, 2009SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute aCVE-2008-6236 · Other software · Cafuego · reported by MITREHigh 7.5
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Simple Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 20, 2009SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute aCVE-2008-6220 · Other software · Cafuego · reported by MITREHigh 7.5
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the pass parameter.
- Product
- Simple Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Aug 20, 2008Cross-site scripting (XSS) vulnerability in Nordicwind Document Management System (NOAH) before 3.2.2 allows remote attackers to inject arbitrary web script or CVE-2008-3730 · Other software · Nordicwind · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Nordicwind Document Management System (NOAH) before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Noah
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2007Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read arbitrary files via a ..CVE-2007-6400 · Other software · Poldoc · reported by MITREMedium 5
Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read arbitrary files via a .. (dot dot) or absolute pathname in the filename parameter.
- Product
- Poldoc Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Nov 29, 2005Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands CVE-2005-3877 · Other software · Cafuego · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the (1) folder_id parameter in list.php and (2) mid parameter in a view action to messages.php.
- Product
- Simple Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpridels0.blogspot.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.