Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Mar 8, 2026A security flaw has been discovered in doramart DoraCMS 3.0.x.CVE-2026-3795 · Other software · doramart · reported by VulDBLow 2.1
A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DoraCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A vulnerability was identified in doramart DoraCMS 3.0.x.CVE-2026-3794 · Other software · doramart · reported by VulDBMedium 5.5
A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DoraCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality.CVE-2026-25870 · Other software · doramart · reported by VulnCheckMedium 6.9
DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.
- Product
- DoraCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/publicCVE-2024-28715 · Other software · Html-js · reported by MITREHigh 8.8
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.CVE-2023-51840 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatarCVE-2023-49444 · Other software · Html-js · reported by MITREMedium 5.4
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords.CVE-2023-49443 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.CVE-2022-35147 · Other software · Html-js · reported by MITRECritical 9.8
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2022A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTMCVE-2022-25464 · Other software · Html-js · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBCCVE-2020-18220 · Other software · Html-js · reported by MITREHigh 7.5
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2018Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via tCVE-2018-16622 · Other software · Html-js · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.