Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38 results
Oct 21, 2026A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837.CVE-2026-114249 · Other software · dhikshitha29 · reported by VulDBMedium 5.5
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Insurance-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bCVE-2026-114248 · Other software · dhikshitha29 · reported by VulDBMedium 5.5
A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The manipulation of the argument submit/Plan_no/Name leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Insurance-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837.CVE-2026-114245 · Other software · dhikshitha29 · reported by VulDBMedium 5.5
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Insurance-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd83CVE-2026-114243 · Other software · dhikshitha29 · reported by VulDBMedium 5.5
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Insurance-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837.CVE-2026-114242 · Other software · dhikshitha29 · reported by VulDBMedium 5.5
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Insurance-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Insurance: Deserialization of Untrusted DataCVE-2025-31634 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.
- Product
- Insurance
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Insurance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2024A vulnerability was found in Project Worlds Life Insurance Management System 1.0.CVE-2024-10735 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /editNominee.php. The manipulation of the argument nominee_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Life Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2024A vulnerability was found in Project Worlds Life Insurance Management System 1.0.CVE-2024-10734 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /editPayment.php. The manipulation of the argument recipt_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Life Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the CVE-2024-36599 · Other software · Aegon · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php.
- Product
- Life Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 14, 2024An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.CVE-2024-36598 · Other software · projectworlds · reported by MITREHigh 8.1
An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
- Product
- life_insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.CVE-2024-36597 · Other software · Projectworlds · reported by MITREHigh 8.8
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
- Product
- Life Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 26, 2024An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff.CVE-2024-31502 · Other software · munyweki · reported by MITREHigh 8.1
An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected CVE-2024-31648 · Other software · insurance_management_system_project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at /core/new_category2.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.CVE-2024-31065 · Other software · sourcecodester · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input CVE-2024-31064 · Other software · Munyweki · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 28, 2024Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input fieldCVE-2024-31063 · Other software · sourcecodester · reported by MITREMedium 6.4
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input fielCVE-2024-31062 · Other software · sourcecodester · reported by MITREMedium 6.3
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input fCVE-2024-31061 · Other software · insurance_management_system_project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field.
- Product
- insurance_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability was found in phpscriptpoint Insurance 1.2.CVE-2023-3861 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability was found in phpscriptpoint Insurance 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /search.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235213 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Insurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2023A vulnerability was found in phpscriptpoint Insurance 1.2.CVE-2023-3860 · Websites & servers · phpscriptpoint · reported by VulDBLow 3.5
A vulnerability was found in phpscriptpoint Insurance 1.2. It has been classified as problematic. Affected is an unknown function of the file /page.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235212. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Insurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023WP Insurance: Does not have CSRF checkCVE-2023-0501 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Insurance
- Fixed in
- 2.1.4
- What to do
- Update WP Insurance to 2.1.4 or newer.
Jun 20, 2022NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack.CVE-2021-45918 · Other software · NHI · reported by twcert@cert.org.twHigh 7.5
NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in order to terminate service without authentication, which requires a system restart to recover service.
- Product
- health insurance web service component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=.CVE-2022-30002 · Other software · Angeljudesuarez · reported by MITREHigh 7.2
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=.CVE-2022-30001 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.CVE-2022-30000 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=.CVE-2022-29999 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client_id=.CVE-2022-29998 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client_id=.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-27124 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- Product
- Insurance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle Insurance Accounting Analyzer product of Oracle Financial Services Applications (component: User Interface).CVE-2020-14693 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Insurance Accounting Analyzer product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6-8.0.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Insurance Accounting Analyzer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Insurance Accounting Analyzer accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
- Product
- Insurance Accounting Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104CVE-2020-6268 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.1
Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.
- Product
- SAP ERP (Statutory Reporting for Insurance Companies)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Apr 15, 2020Vulnerability in the Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management product of Oracle Financial Services Applications (cCVE-2020-2945 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management product of Oracle Financial Services Applications (component: User Interfaces). Supported versions that are affected are 8.0.7 and 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management accessible data as well as unauthorized read access to a subset of Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Financial Services Deposit Insurance Calculations for Liquidity Risk Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Oracle Insurance Accounting Analyzer product of Oracle Financial Services Applications (component: User Interface).CVE-2020-2937 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Insurance Accounting Analyzer product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6 - 8.0.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Insurance Accounting Analyzer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Insurance Accounting Analyzer accessible data as well as unauthorized read access to a subset of Oracle Insurance Accounting Analyzer accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Insurance Accounting Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2019Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecifiCVE-2019-5923 · Other software · iChain, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- Product
- iChain Insurance Wallet App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver.CVE-2016-7818 · Other software · Japan Pension Service · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Intstaller for Specification check program(social insurance)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnenkin.go.jpnenkin.go.jp
May 5, 2017The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers andCVE-2017-5919 · Other software · 21st Century Insurance · reported by MITREMedium 5.9
The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 21st Century Insurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2014The Car Insurance Quote Comparison (aka com.seopa.quotezone) application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-iCVE-2014-7102 · Other software · Quotezone · reported by cret@cert.orgMedium 5.4
The Car Insurance Quote Comparison (aka com.seopa.quotezone) application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- CAR Insurance Quote Comparison
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 16, 2014The MiWay Insurance Ltd (aka com.MiWay.MD) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2014-6979 · Other software · Miway · reported by cret@cert.orgMedium 5.4
The MiWay Insurance Ltd (aka com.MiWay.MD) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Miway Insurance LTD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 26, 2013Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allowsCVE-2013-6284 · Network & remote access · SAP · reported by MITREHigh 7.5
Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."
- Product
- ERP Central Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscn.sap.comlayersevensecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.