Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
63 results · page 1 of 2
Oct 15, 2026FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked CVE-2026-111149 · Other software · danoli3 · reported by VulnCheckMedium 6.9
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
- Product
- FreeImage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPassCVE-2026-102782 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT proCVE-2026-86201 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messagesCVE-2026-86200 · Other software · pmmp · reported by VulnCheckMedium 6.9
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendinCVE-2024-58381 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependenCVE-2023-54393 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arraCVE-2023-54390 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve.CVE-2023-54355 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacketCVE-2022-51008 · Other software · pmmp · reported by VulnCheckMedium 6.9
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2026-18292 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro . User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29335.
- Product
- OriginPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.originlab.comzerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2026-18291 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGW files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29334.
- Product
- OriginPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.originlab.comzerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18290 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29333.
- Product
- OriginPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.originlab.comzerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18289 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29332.
- Product
- OriginPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.originlab.comzerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18288 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-29331.
- Product
- OriginPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.originlab.comzerodayinitiative.com
Jul 9, 2026LoginPress Pro: Authentication bypassCVE-2026-12598 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.
- Product
- LoginPress Pro
- Affected
- up to 6.2.3
- What to do
- Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginpress.prowordfence.com
Jul 9, 2026LoginPress Pro: Authentication BypassCVE-2026-12597 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter — causing the plugin to call get_user_by('email', ...) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the /user/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.
- Product
- LoginPress Pro
- Affected
- up to 6.2.3
- What to do
- Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginpress.prowordfence.com
Jul 9, 2026LoginPress Pro: Authentication BypassCVE-2026-12595 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.
- Product
- LoginPress Pro
- Affected
- up to 6.2.3
- What to do
- Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginpress.prowordfence.com
Jun 17, 2026Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.CVE-2026-49058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended.CVE-2025-47910 · Other software · Go standard library · reported by security@golang.orgMedium 5.4
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025LoginPress Pro: Authentication bypassCVE-2025-7444 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- LoginPress Pro
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginpress.prowordfence.com
Mar 28, 2025PluginPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54291 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.
- Product
- PluginPass
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update PluginPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2025LoginPress | wp-login Custom Login Page Customizer: Cross-Site Request ForgeryCVE-2025-1764 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
- Product
- LoginPress | wp-login Custom Login Page Customizer
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update LoginPress | wp-login Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2025An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc alloCVE-2025-25363 · Other software · Thepluginpeople · reported by MITREMedium 6.5
An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template.
- Product
- Enterprise Mail Handler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commarketplace.atlassian.com
Jan 16, 2025Loginplus: Missing AuthorizationCVE-2025-23514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Loginplus: from n/a through <= 1.2.
- Product
- Loginplus
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Loginplus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanjay Prasad Loginplus loginplus allows Stored XSS.This issue affects Loginplus: from n/a through <= 1.2.
- Product
- Loginplus
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2024An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter CVE-2024-48779 · Other software · wanxingtechnology · reported by MITRECritical 9.8
An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter to specify that the qt plugin loads the directory.
- Product
- yitu_project_management_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2024app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in CVE-2024-46918 · Other software · misp · reported by MITREMedium 4.9
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability.CVE-2023-34274 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20552.
- Product
- DIR-2150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability.CVE-2023-32152 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comMedium 6.5
D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2640 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management interface, which listens on TCP port 80 by default. A specially crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-19549.
- Product
- DIR-2640
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
- Product
- LoginPress Pro
- Fixed in
- 3.0.0
- What to do
- Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024LoginPress Pro: Missing AuthorizationCVE-2024-32677 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.
- Product
- LoginPress Pro
- Fixed in
- 3.0.0
- What to do
- Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 18, 2024Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.CVE-2024-26318 · Other software · Serenity · reported by MITREMedium 6.1
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
- Product
- Serenity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordserenity.isserenity.is
Aug 28, 2023An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.CVE-2023-40827 · Other software · Pf4j Project · reported by MITREHigh 7.5
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
- Product
- Pf4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2023An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.CVE-2023-40826 · Other software · Pf4j Project · reported by MITREHigh 7.5
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
- Product
- Pf4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.CVE-2023-37892 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.
- Affected
- up to 6.0.8
- What to do
- Affects up to 6.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2023Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.CVE-2023-24241 · Other software · Forget Heart Message BOX Project · reported by MITRECritical 9.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
- Product
- Forget Heart Message BOX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth: Broken Access ControlCVE-2022-41839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
- Product
- WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 20, 2022Origin Protocol is a blockchain based project.CVE-2022-24864 · Other software · OriginProtocol · reported by GitHubMedium 4.1
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds.
- Product
- origin-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.CVE-2022-25454 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022LoginPress | Custom Login Page Customizer: Does not escape the redirect-page parameter before outputting it back in an attributeCVE-2022-0347 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- LoginPress | Custom Login Page Customizer
- Fixed in
- 1.5.12
- What to do
- Update LoginPress | Custom Login Page Customizer to 1.5.12 or newer.
Feb 24, 2022A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.CVE-2021-45746 · Other software · Webank · reported by MITREHigh 7.5
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
- Product
- Wecube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2021Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to tCVE-2021-3401 · Other software · Bitcoin · reported by MITRECritical 9.8
Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."
- Product
- Bitcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordachow101.comgithub.com
Feb 18, 2020Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml bindingCVE-2013-5594 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgnki.gov.hu
Feb 13, 2020A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POSTCVE-2020-8962 · Other software · Dlink · reported by MITRECritical 9.8
A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint.
- Product
- Dir-842 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.CVE-2019-15872 · WordPress plugins & themes · reported by MITRECritical 9.8
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
- Product
- LoginPress
- Fixed in
- 1.1.4
- What to do
- Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwebarxsecurity.com
Sep 3, 2019The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.CVE-2019-15871 · WordPress plugins & themes · reported by MITREMedium 4.3
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
- Product
- LoginPress
- Fixed in
- 1.1.4
- What to do
- Update LoginPress to 1.1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwebarxsecurity.com
May 12, 2018ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.CVE-2018-11012 · Other software · Halo · reported by MITREMedium 6.1
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2017On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to goform/login causes tCVE-2017-16902 · Other software · Vonage · reported by MITREHigh 7.5
On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to goform/login causes the router to reboot.
- Product
- Vdv-23 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgh0s7.netexploit-db.com
Mar 17, 2017TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartextCVE-2017-6370 · Other software · Typo3 · reported by MITREMedium 5.3
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Sep 29, 2015Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via veCVE-2015-0852 · Other software · Freeimage Project · reported by security@debian.orgMedium 5
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Product
- Freeimage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.