Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
55 results · page 1 of 2
Oct 6, 2026Booknetic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39746 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.
- Product
- Booknetic
- Fixed in
- 5.10.3
- What to do
- Update Booknetic to 5.10.3 or newer.
Aug 27, 2026darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length.CVE-2026-81334 · Other software · hank-ai · reported by VulnCheckMedium 6.9
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file.
- Product
- darknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int CVE-2026-72852 · Other software · hank-ai · reported by VulnCheckHigh 8.5
hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write.
- Product
- darknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Booknetic: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25439 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.
- Product
- Booknetic
- Fixed in
- 5.10.3
- What to do
- Update Booknetic to 5.10.3 or newer.
Nov 11, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc.CVE-2025-11960 · Other software · Aryom Software High Technology Systems Inc. · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8.
- Product
- KVKNET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 16, 2025desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.CVE-2025-58426 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 5.3
desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applicatioCVE-2025-58079 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-55072 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-54859 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.6
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-54760 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.CVE-2025-52583 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 5.1
Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.CVE-2025-24833 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on WindowsCVE-2025-10221 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Medium 6.7
Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Windows platforms allows a local attacker to obtain plaintext credentials via reading TRACE log files containing serialized JSON with passwords.
- Product
- AxxonNet ARP Agent C-WerkNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could alloCVE-2025-29072 · Other software · Nethermind · reported by MITREHigh 7.5
An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.
- Product
- Juno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.starknet.iogithub.com
Mar 26, 2025Booknetic: Does not have CSRF checkCVE-2024-13146 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack
- Product
- Booknetic
- Fixed in
- 4.1.5
- What to do
- Update Booknetic to 4.1.5 or newer.
Mar 12, 2025SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function.CVE-2025-25568 · Other software · Softether · reported by MITRECritical 9.8
SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack).
- Product
- VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.softether-upload.comlzydry.github.io
Feb 25, 2025Booknetic: Cross-Site Request Forgery (CSRF)CVE-2025-26926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site Request Forgery.This issue affects Booknetic: from n/a before 5.10.4.
- Product
- Booknetic
- Fixed in
- 5.10.4
- What to do
- Update Booknetic to 5.10.4 or newer.
Aug 30, 2024Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup.CVE-2024-45304 · Other software · OpenZeppelin · reported by GitHubMedium 5.3
Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintended party (pending owner) can gain control of the contract after the original owner has renounced ownership. This could also be used by a malicious owner to simulate leaving a contract without an owner, to later regain ownership by previously having proposed himself as a pending owner. This issue has been addressed in release version 0.16.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cairo-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup.CVE-2023-23940 · Other software · OpenZeppelin · reported by GitHubMedium 6.4
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
- Product
- cairo-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023A vulnerability was found in kirill2485 TekNet.CVE-2014-125031 · Other software · kirill2485 · reported by VulDBLow 3.5
A vulnerability was found in kirill2485 TekNet. It has been classified as problematic. Affected is an unknown function of the file pages/loggedin.php. The manipulation of the argument statusentery leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 1c575340539f983333aa43fc58ecd76eb53e1816. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217176.
- Product
- TekNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a crosCVE-2020-23592 · Other software · Optilinknetwork · reported by MITREHigh 8.8
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_CVE-2020-23591 · Other software · Optilinknetwork · reported by MITRECritical 9.8
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a crossCVE-2020-23590 · Other software · Optilinknetwork · reported by MITREMedium 6.5
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a crosCVE-2020-23589 · Other software · Optilinknetwork · reported by MITREMedium 6.5
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a crosCVE-2020-23588 · Other software · Optilinknetwork · reported by MITREMedium 4.3
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to condCVE-2020-23587 · Other software · Optilinknetwork · reported by MITRELow 3.1
A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct CVE-2020-23586 · Other software · Optilinknetwork · reported by MITREMedium 4.3
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using "CVE-2020-23584 · Other software · Optilinknetwork · reported by MITRECritical 9.8
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a crossCVE-2020-23593 · Other software · Optilinknetwork · reported by MITREMedium 6.5
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028.CVE-2020-23585 · Other software · Optilinknetwork · reported by MITREHigh 8.8
A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution.CVE-2020-23583 · Other software · Optilinknetwork · reported by MITRECritical 9.8
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site rCVE-2020-23582 · Other software · Optilinknetwork · reported by MITREMedium 6.5
A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.
- Product
- Op-xt71000n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.CVE-2022-24692 · Other software · DSK · reported by MITREMedium 5.4
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution.
- Product
- Dsknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.CVE-2022-24691 · Other software · DSK · reported by MITREHigh 7.1
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based.
- Product
- Dsknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.CVE-2022-24690 · Other software · DSK · reported by MITREHigh 8.2
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)
- Product
- Dsknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.CVE-2022-24689 · Other software · DSK · reported by MITREMedium 5.3
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts.
- Product
- Dsknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.CVE-2022-24688 · Other software · DSK · reported by MITREHigh 8.8
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.
- Product
- Dsknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup.CVE-2022-31153 · Other software · OpenZeppelin · reported by GitHubMedium 6.5
OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.
- Product
- cairo-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet funCVE-2021-43163 · Other software · Ruijienetworks · reported by MITRECritical 9.8
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.
- Product
- Reyeeos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 25, 2021An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticated attackers to exfilCVE-2021-27823 · Computers, phones & browsers · Mediateknet · reported by MITREHigh 7.5
An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticated attackers to exfiltrate sensitive information from the system.
- Product
- Netwave System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmediateknet.netnetwavesystem.net
Dec 3, 2020Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earliCVE-2020-5638 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.
- Product
- desknet's NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2020RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure.CVE-2013-5687 · Other software · Aicorporation · reported by MITREHigh 7.5
RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure.
- Product
- Risknet Acquirer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Sep 20, 2018LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.CVE-2018-16752 · Other software · Linknet-usa · reported by MITREHigh 8.8
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
- Product
- Lw-n605r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 14, 2018K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php.CVE-2018-17051 · Other software · Knet · reported by MITREMedium 6.1
K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php.
- Product
- Cisco Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attackCVE-2018-0496 · Other software · Dinknetwork · reported by security@debian.orgHigh 7.5
Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.
- Product
- Dfarc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orglists.debian.org
Sep 4, 2015Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arbitrary files via a cCVE-2015-2990 · Other software · Neojapan · reported by vultures@jpcert.or.jpMedium 4
Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arbitrary files via a crafted parameter.
- Product
- Desknet NEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2010The embedded HTTP server in multiple Lexmark laser and inkjet printers and MarkNet devices, including X94x, W840, T656, N4000, E462, C935dn, 25xxN, and other moCVE-2010-0101 · Other software · Lexmark · reported by cret@cert.orgHigh 7.8
The embedded HTTP server in multiple Lexmark laser and inkjet printers and MarkNet devices, including X94x, W840, T656, N4000, E462, C935dn, 25xxN, and other models, allows remote attackers to cause a denial of service (operating system halt) via a malformed HTTP Authorization header.
- Product
- 25xxn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lexmark.comsupport.lexmark.com
Jul 5, 2009Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a ..CVE-2009-2325 · Other software · Clicknet · reported by MITREMedium 5
Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the side parameter.
- Product
- Clicknet CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
May 29, 2009Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query.CVE-2009-1830 · Other software · Slsknet · reported by MITREHigh 10
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query.
- Product
- Soulseek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Jun 3, 2008SQL injection vulnerability in the Autopatcher server plugin in RakNet before 3.23 allows remote attackers to execute arbitrary SQL commands via unspecified vecCVE-2008-2523 · Other software · Raknet · reported by MITREHigh 7.5
SQL injection vulnerability in the Autopatcher server plugin in RakNet before 3.23 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Autopatcher Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comjenkinssoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.