Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

36 results

Jul 30, 2026A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the aCVE-2026-48910 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 30, 2026Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variableCVE-2026-28814 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 30, 2026Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.CVE-2026-28813 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 30, 2026UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.CVE-2026-28812 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 30, 2026Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.CVE-2026-28811 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org lists.apache.org
Jul 31, 2025A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript CVE-2025-24854 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org openwall.com
Jul 31, 2025A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's broCVE-2025-24853 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org openwall.com
Jun 24, 2024XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abouCVE-2024-27136 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org lists.apache.org
May 25, 2023A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascripCVE-2022-46907 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Aug 4, 2022A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escaCVE-2022-34158 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Aug 4, 2022A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the viCVE-2022-28732 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Aug 4, 2022A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modifyCVE-2022-28731 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Aug 4, 2022A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in theCVE-2022-28730 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Aug 4, 2022A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attackeCVE-2022-27166 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Feb 25, 2022A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could alCVE-2022-24948 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Feb 25, 2022Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover.CVE-2022-24947 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 24, 2021Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logoutCVE-2021-44140 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org lists.apache.org
Nov 24, 2021A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker CVE-2021-40369 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jspwiki-wiki.apache.org
Sep 23, 2019On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remeCVE-2019-12407 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Sep 23, 2019On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plaiCVE-2019-10090 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Sep 23, 2019On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContCVE-2019-12404 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Sep 23, 2019On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSICVE-2019-10089 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
Sep 23, 2019On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the PageCVE-2019-10087 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jspwiki-wiki.apache.org jspwiki-wiki.apache.org
May 20, 2019A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.CVE-2019-10078 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
May 20, 2019A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.CVE-2019-10077 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
May 20, 2019A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.CVE-2019-10076 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 28, 2019A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by aCVE-2019-0225 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 28, 2019In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session.CVE-2019-0224 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jspwiki-wiki.apache.org
Feb 11, 2019A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.CVE-2018-20242 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
Product
Apache JSPWiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com lists.apache.org
Mar 10, 2008Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified maniCVE-2008-1230 · Other software · Jspwiki · reported by MITREHigh 9.3
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Mar 10, 2008Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtaCVE-2008-1231 · Other software · Jspwiki · reported by MITREHigh 9.3
Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Mar 10, 2008Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editoCVE-2008-1229 · Other software · Jspwiki · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com
Sep 27, 2007JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information (full path) via an invalid integer in the version parameter to the defaCVE-2007-5119 · Other software · Jspwiki · reported by MITREMedium 4.3
JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information (full path) via an invalid integer in the version parameter to the default URI under attach/Main/.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Sep 27, 2007Cross-site scripting (XSS) vulnerability in JSPWiki 2.5.139-beta allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to wiCVE-2007-5121 · Other software · Jspwiki · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in JSPWiki 2.5.139-beta allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to wiki-3/Login.jsp and unspecified other components.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Sep 27, 2007Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1CVE-2007-5120 · Other software · Jspwiki · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1) group and (2) members parameters in (a) NewGroup.jsp; the (3) edittime parameter in (b) Edit.jsp; the (4) edittime, (5) author, and (6) link parameters in (c) Comment.jsp; the (7) loginname, (8) wikiname, (9) fullname, and (10) email parameters in (d) UserPreferences.jsp and (e) Login.jsp; the (11) r1 and (12) r2 parameters in (f) Diff.jsp; and the (13) changenote parameter in (g) PageInfo.jsp.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.grok.org.uk secunia.com
Dec 31, 2004Cross-site scripting (XSS) vulnerability in Search.jsp in JSPWiki 2.1.120-cvs and earlier allows remote attackers to execute arbitrary web script as other usersCVE-2004-1544 · Other software · Jspwiki · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Search.jsp in JSPWiki 2.1.120-cvs and earlier allows remote attackers to execute arbitrary web script as other users via the query parameter.
Product
Jspwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.