Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Jul 22, 2019Frog CMS 1.1 is affected by: Cross Site Scripting (XSS).CVE-2019-1010235 · Other software · Frog CMS · reported by josh@bress.netMedium 5.4
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsomerandomshitwbu.blogspot.comsomerandomshitwbu.blogspot.com
Feb 10, 2019admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.CVE-2018-20778 · Other software · Frog CMS Project · reported by MITREMedium 6.1
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.CVE-2018-20777 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 provides a directory listing for a /public request.CVE-2018-20776 · Other software · Frog CMS Project · reported by MITREHigh 7.5
Frog CMS 0.9.5 provides a directory listing for a /public request.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the pCVE-2018-20775 · Other software · Frog CMS Project · reported by MITREHigh 7.2
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.CVE-2018-20774 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.CVE-2018-20773 · Other software · Frog CMS Project · reported by MITREHigh 7.2
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.CVE-2018-20772 · Other software · Frog CMS Project · reported by MITREHigh 7.2
Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2019Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).CVE-2019-6243 · Other software · Frog CMS Project · reported by MITREMedium 6.1
Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsomerandomshitwbu.blogspot.comsomerandomshitwbu.blogspot.com
Jan 9, 2019Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.CVE-2018-20680 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.CVE-2018-19844 · Other software · Frogcms Project · reported by MITREMedium 4.8
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2018Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.CVE-2018-20448 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 4, 2018Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.CVE-2018-16447 · Other software · Frogcms Project · reported by MITREHigh 8.8
Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.CVE-2018-16374 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2018Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.CVE-2018-16373 · Other software · Frog CMS Project · reported by MITREMedium 4.9
Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2018An issue was discovered in Frog CMS 0.9.5.CVE-2018-11098 · Other software · Frog CMS Project · reported by MITREHigh 7.2
An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2018An issue was discovered in Frog CMS 0.9.5.CVE-2018-10806 · Other software · Frogcms Project · reported by MITREMedium 5.4
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2018Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.CVE-2018-10570 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2018Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.CVE-2018-10321 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 23, 2018Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.CVE-2018-10320 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2018Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.CVE-2018-10319 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2018Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.CVE-2018-10318 · Other software · Frogcms Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
- Product
- Frogcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2018Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.CVE-2018-9992 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 11, 2018Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.CVE-2018-9991 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 31, 2018An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5.CVE-2018-8908 · Other software · Frog CMS Project · reported by MITREHigh 8.8
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritywarrior9.blogspot.inexploit-db.com
Mar 22, 2018An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.CVE-2014-4912 · Other software · Frog CMS Project · reported by MITRECritical 9.8
An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.