Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
176 results · page 1 of 4
Sep 3, 2026Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.CVE-2026-84778 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
- Affected
- up to 6.65
- What to do
- Affects up to 6.65. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 15, 2026The HCM developed by MetaGuru has a SQL Injection vulnerability.CVE-2026-15804 · Other software · MetaGuru · reported by twcert@cert.org.twHigh 8.7
The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data.
- Product
- HCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 10, 2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl lCVE-2026-7259 · Websites & servers · PHP Group · reported by security@php.netLow 2.1
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page.CVE-2026-36388 · Other software · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker (patient) to inject a malicious script payload into the User Name parameter, which is stored in the application and later rendered in the doctor s interface.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android.CVE-2026-5457 · Other software · PropertyGuru · reported by VulDBLow 1.9
A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AgentNet Singapore App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules).CVE-2026-4744 · Other software · rizonesoft · reported by cve_disclosure@tech.gov.sgCritical 9.3
Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C. This issue affects Notepad3: before 6.25.714.1.
- Product
- Notepad3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules).CVE-2026-24796 · Other software · CloverHackyColor · reported by cve_disclosure@tech.gov.sgMedium 6.9
Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regparse.C. This issue affects CloverBootloader: before 5162.
- Product
- CloverBootloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules).CVE-2026-24795 · Other software · CloverHackyColor · reported by cve_disclosure@tech.gov.sgMedium 5.1
Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regcomp.C. This issue affects CloverBootloader: before 5162.
- Product
- CloverBootloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0.CVE-2025-70890 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The injected payload is stored and executed in the victim s browser when the affected page is accessed.
- Product
- Cyber Cafe Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Sep 16, 2025A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application.CVE-2025-57145 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser.
- Product
- Auto Taxi Stand Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCVE-2025-57119 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function
- Product
- Online Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025ads.txt Guru Connect: Cross-Site Request Forgery (CSRF)CVE-2025-49381 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through <= 1.1.1.
- Product
- ads.txt Guru Connect
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update ads.txt Guru Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload tCVE-2024-27685 · Websites & servers · Phpgurukul · reported by MITREHigh 7.1
SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.
- Product
- Student Record System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpgurukul.com
May 23, 2025An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fileCVE-2024-51360 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical.CVE-2025-4214 · Websites & servers · PHPGuruku · reported by VulDBMedium 6.9
A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online DJ Booking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Error Log Viewer By WP Guru: Arbitrary File ReadCVE-2024-12849 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Error Log Viewer By WP Guru
- Affected
- up to 1.0.1.3
- What to do
- Affects up to 1.0.1.3. Update Error Log Viewer By WP Guru to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailiCVE-2024-55104 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters.
- Product
- Online Nurse Hiring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Dec 16, 2024Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.CVE-2024-55103 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.
- Product
- Online Nurse Hiring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Dec 16, 2024A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary wCVE-2024-55100 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter.
- Product
- Online Nurse Hiring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Dec 14, 2024WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More: Stored Cross-Site ScriptingCVE-2024-12411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 20, 2024Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML viaCVE-2024-51209 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page.
- Product
- Client Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comphpgurukul.com
Nov 20, 2024File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the ImCVE-2024-51208 · Websites & servers · phpgurukul · reported by MITREHigh 7.2
File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter.
- Product
- boat_booking_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comphpgurukul.com
Nov 13, 2024Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminnameCVE-2023-38920 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminname parameter.
- Product
- Cyber Cafe Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload.CVE-2024-50353 · Other software · IowaComputerGurus · reported by GitHubMedium 5.3
ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library.
- Product
- aspnetcore.utilities.cloudstorage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted.CVE-2024-8473 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esMedium 6.3
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through user_email parameter in /jobportal/admin/login.php.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted.CVE-2024-8472 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esMedium 6.3
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through multiple parameters in /jobportal/index.php.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted.CVE-2024-8471 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esMedium 6.3
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, aCVE-2024-8470 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrievCVE-2024-8469 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the iCVE-2024-8468 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrievCVE-2024-8467 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, CVE-2024-8466 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and rCVE-2024-8465 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.phpCVE-2024-8464 · Websites & servers · PHPGurukul · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.
- Product
- Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page.CVE-2024-29390 · Other software · anuj_kumar · reported by MITREHigh 7.3
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.
- Product
- daily_expenses_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Cross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname parameter in edit-comCVE-2024-30979 · Websites & servers · phpgurukul · reported by MITREMedium 5.9
Cross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname parameter in edit-computer-details.php.
- Product
- cyber_cafe_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.CVE-2023-49989 · Websites & servers · phpgurukul · reported by MITRECritical 9.8
Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.
- Product
- hotel_booking_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.CVE-2023-49988 · Websites & servers · phpgurukul · reported by MITREHigh 7.5
Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.
- Product
- hotel_booking_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2024A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0.CVE-2024-0476 · Websites & servers · Phpgurukul · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0. This affects an unknown part of the file request-received-bydonar.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250581 was assigned to this vulnerability.
- Product
- Blood Bank & Donor Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 12, 2024A vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical.CVE-2024-0459 · Websites & servers · Phpgurukul · reported by VulDBMedium 4.7
A vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250564.
- Product
- Blood Bank & Donor Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 10, 2024A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a speciaCVE-2020-26630 · Websites & servers · Phpgurukul · reported by MITREMedium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the 'Doctor Specialization' field under the 'Go to Doctors' tab after logging in as an admin.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 10, 2024A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload aCVE-2020-26629 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 10, 2024A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML cCVE-2020-26628 · Websites & servers · Phpgurukul · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML code via a malicious payload appended to a username on the 'Edit Profile" page and triggered by another user visiting the profile.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 10, 2024A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafteCVE-2020-26627 · Websites & servers · Phpgurukul · reported by MITREMedium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the 'Admin Remark' parameter under the 'Contact Us Queries -> Unread Query' tab.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 30, 2023Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.CVE-2023-48016 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.
- Product
- Restaurant Table Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.CVE-2023-47446 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.
- Product
- Pre-school Enrollment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.CVE-2023-47445 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.
- Product
- Pre-school Enrollment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProductsCVE-2023-40920 · Other software · Prixan · reported by MITRECritical 9.8
Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProducts().
- Product
- Prixanconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 30, 2023A vulnerability, which was classified as problematic, was found in Online Banquet Booking System 1.0.CVE-2023-5303 · Websites & servers · Phpgurukul · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Online Banquet Booking System 1.0. Affected is an unknown function of the file /view-booking-detail.php of the component Account Detail Handler. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. VDB-240942 is the identifier assigned to this vulnerability.
- Product
- Online Banquet Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execute arbitrary web scrCVE-2023-41614 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description of Animal parameter.
- Product
- ZOO Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.