Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Jan 1, 2026A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0.CVE-2025-15423 · Other software · EmpireSoft · reported by VulDBLow 2.1
A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EmpireCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comnote-hxlab.wetolink.com
Jan 1, 2026A flaw has been found in EmpireSoft EmpireCMS up to 8.0.CVE-2025-15422 · Other software · EmpireSoft · reported by VulDBMedium 5.5
A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EmpireCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comnote-hxlab.wetolink.com
Jan 8, 2024SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.CVE-2023-50162 · Other software · Phome · reported by MITREHigh 7.2
SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.CVE-2023-50073 · Other software · Leadscloud · reported by MITRECritical 9.8
EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.phpCVE-2022-28585 · Other software · Phome · reported by MITRECritical 9.8
EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2021A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install fCVE-2020-22937 · Other software · Phome · reported by MITRECritical 9.8
A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 7, 2019admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OCVE-2018-19462 · Other software · Phome · reported by MITREHigh 7.2
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2019admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.CVE-2018-19461 · Other software · Phome · reported by MITREMedium 4.8
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2019EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.CVE-2019-12362 · Other software · Phome · reported by MITREMedium 6.1
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2019EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template.CVE-2019-12361 · Other software · Phome · reported by MITREMedium 6.1
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.CVE-2018-18449 · Other software · Phome · reported by MITREHigh 8.8
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2018Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected intCVE-2018-20300 · Other software · Phome · reported by MITRECritical 9.8
Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordp0desta.comp0desta.com
Oct 31, 2018EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php pCVE-2018-18869 · Other software · Phome · reported by MITRECritical 9.8
EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqclover.github.ioqclover.github.io
Oct 9, 2018EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.CVE-2018-18086 · Other software · Phome · reported by MITREHigh 8.8
EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018An issue was discovered in EmpireCMS 7.0.CVE-2018-16339 · Other software · Phome · reported by MITREHigh 8.8
An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2018EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.CVE-2018-6881 · Other software · Dedecms · reported by MITREMedium 5.3
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkongxin.gitbook.io
Feb 11, 2018EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.CVE-2018-6880 · Other software · Phome · reported by MITREMedium 5.3
EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkongxin.gitbook.io
Nov 15, 2012Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackerCVE-2012-5777 · Other software · Phome · reported by MITREMedium 6.8
Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.