Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Dec 3, 2025Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29.CVE-2025-29864 · Other software · ESTsoft · reported by vuln@krcert.or.krMedium 6.2
Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29.
- Product
- ALZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645.CVE-2022-43665 · Other software · ESTsoft · reported by talos-cna@cisco.comMedium 5.5
A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-crafted PE file can lead to killing target process. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Alyac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files.CVE-2022-32543 · Other software · ESTsoft · reported by talos-cna@cisco.comHigh 7.8
An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heap buffer overflow which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Alyac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Aug 5, 2022An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files.CVE-2022-29886 · Other software · ESTsoft · reported by talos-cna@cisco.comHigh 7.8
An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heap buffer overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Alyac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 12, 2022An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7.CVE-2022-21147 · Other software · ESTsoft · reported by talos-cna@cisco.comMedium 5.5
An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-crafted PE file can trigger this vulnerability to cause denial of service and termination of malware scan. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Alyac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comestsecurity.com
Jun 11, 2021UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG.CVE-2020-7860 · Other software · Estsoft · reported by vuln@krcert.or.krHigh 7.8
UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG. Attackers could exploit this and arbitrary code execution. This issue affects: Estsoft UnEGG 0.5 versions prior to 1.0 on linux.
- Product
- UnEGG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaltools.co.kraltools.co.kr
Jul 5, 2020An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress.CVE-2020-15536 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
- Product
- An issue was discovered in the bestsoftinc Hotel Booking System Pro
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update An issue was discovered in the bestsoftinc Hotel Booking System Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jul 5, 2020An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress.CVE-2020-15535 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
- Product
- An issue was discovered in the bestsoftinc Car Rental System
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update An issue was discovered in the bestsoftinc Car Rental System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
May 15, 2020ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input.CVE-2020-7809 · Other software · ALSong · reported by vuln@krcert.or.krMedium 4.4
ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file.
- Product
- Estsoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaltools.co.krboho.or.kr
Aug 30, 2019A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39.CVE-2019-12810 · Other software · ESTSOFT · reported by vuln@krcert.or.krHigh 7.8
A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .PSD file can cause an out of bounds write vulnerability resulting in code execution. By persuading a victim to open a specially-crafted .PSD file, an attacker could execute arbitrary code.
- Product
- ALSee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2019ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission.CVE-2019-12808 · Other software · ESTSOFT · reported by vuln@krcert.or.krHigh 7.8
ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges.
- Product
- ALTOOLS Update Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2019Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing of crafted ISO archiCVE-2019-12807 · Other software · ESTSOFT · reported by vuln@krcert.or.krHigh 7.8
Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing of crafted ISO archive file format. By persuading a victim to open a specially-crafted ISO archive file, an attacker could execution arbitrary code.
- Product
- ALZIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaltools.co.krboho.or.kr
Dec 21, 2018Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking.CVE-2018-5196 · Other software · Estsoft · reported by vuln@krcert.or.krHigh 8.8
Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file, a attacker could execute arbitrary code execution.
- Product
- Alzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaltools.co.krboho.or.kr
May 17, 2018ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFICVE-2018-10027 · Other software · Estsoft · reported by MITREHigh 7.8
ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILES(X86)%\ESTsoft\ALZip\Formats, or %PROGRAMFILES(X86)%\ESTsoft\ALZip\Coders.
- Product
- Alzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comaltools.co.kr
Aug 19, 2017Stack-based buffer overflow in ESTsoft ALZip 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted MS-DOS device file, as demonstrateCVE-2017-11323 · Other software · Estsoft · reported by MITREHigh 7.8
Stack-based buffer overflow in ESTsoft ALZip 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted MS-DOS device file, as demonstrated by use of "AUX" as the initial substring of a filename.
- Product
- Alzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit.kitploit.comaltools.com
Nov 3, 2014ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate folder and (2) AlUpdate.exe, which allows local users to gain privilCVE-2014-8494 · Other software · Estsoft · reported by MITREMedium 4.6
ESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate folder and (2) AlUpdate.exe, which allows local users to gain privileges via a Trojan horse file.
- Product
- Alupdate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 11, 2014Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc.CVE-2014-4035 · Other software · Bestsoftinc · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
- Product
- Advance Hotel Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 6, 2012Untrusted search path vulnerability in ALSee 6.20.0.1 allows local users to gain privileges via a Trojan horse patchani.dll file in the current working directorCVE-2010-5211 · Other software · Estsoft · reported by MITREMedium 6.9
Untrusted search path vulnerability in ALSee 6.20.0.1 allows local users to gain privileges via a Trojan horse patchani.dll file in the current working directory, as demonstrated by a directory that contains a .ani, .bmp, .cal, .hdp, .jpe, .mac, .pbm, .pcx, .pgm, .png, .psd, .ras, .tga, or .tiff file. NOTE: some of these details are obtained from third party information.
- Product
- Alsee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcore.yehg.netsecunia.com
Feb 22, 2012Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accesseCVE-2012-0315 · Other software · Estsoft · reported by vultures@jpcert.or.jpHigh 9.3
Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file.
- Product
- Alftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2011SQL injection vulnerability in index1.php in Best Soft Inc.CVE-2010-4814 · Other software · Bestsoftinc · reported by MITREHigh 7.5
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
- Product
- Advance Hotel Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Jul 7, 2011Buffer overflow in ALZip 8.21 and earlier allows remote attackers to execute arbitrary code via a crafted mim file.CVE-2011-1336 · Other software · Estsoft · reported by vultures@jpcert.or.jpHigh 9.3
Buffer overflow in ALZip 8.21 and earlier allows remote attackers to execute arbitrary code via a crafted mim file.
- Product
- Alzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2008Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary filesCVE-2008-2702 · Other software · Estsoft · reported by MITREHigh 9.3
Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Product
- Alftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2006Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading CVE-2006-2899 · Other software · Estsoft · reported by MITREMedium 6.5
Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading a file with multiple extensions into the WebLink directory.
- Product
- Internetdisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecuritytracker.com
Oct 14, 2005Multiple buffer overflows in ALZip 6.12 (Korean), 6.1 (International), and 5.52 (English) allow remote attackers to execute arbitrary code via a long filename iCVE-2005-3194 · Other software · Estsoft · reported by MITREMedium 5.1
Multiple buffer overflows in ALZip 6.12 (Korean), 6.1 (International), and 5.52 (English) allow remote attackers to execute arbitrary code via a long filename in a compressed (1) ALZ, (2) ARJ, (3) ZIP, (4) UUE, or (5) XXE archive.
- Product
- Alzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.