Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 25, 2026A vulnerability has been found in KodCloud KodExplorer up to 4.55.CVE-2026-116057 · Other software · KodCloud · reported by VulDBLow 2.1
A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026A flaw has been found in KodCloud KodExplorer up to 4.56.CVE-2026-116056 · Other software · KodCloud · reported by VulDBMedium 5.3
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recCVE-2026-104081 · Other software · kalcaddle · reported by VulnCheckHigh 7.2
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Apr 19, 2026A security vulnerability has been detected in Collabora KodExplorer up to 4.52.CVE-2026-6572 · Other software · Collabora · reported by VulDBLow 2.9
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A weakness has been identified in kodcloud KodExplorer up to 4.52.CVE-2026-6571 · Other software · kodcloud · reported by VulDBLow 2.1
A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A security flaw has been discovered in kodcloud KodExplorer up to 4.52.CVE-2026-6570 · Other software · kodcloud · reported by VulDBLow 2
A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A vulnerability was identified in kodcloud KodExplorer up to 4.52.CVE-2026-6569 · Other software · kodcloud · reported by VulDBMedium 6.9
A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A vulnerability was determined in kodcloud KodExplorer up to 4.52.CVE-2026-6568 · Other software · kodcloud · reported by VulDBMedium 5.5
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter.CVE-2025-34504 · Other software · kodcloud · reported by VulnCheckMedium 5.3
KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft malicious URLs in the link parameter to redirect users to arbitrary external websites after authentication.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkodcloud.com
Dec 19, 2023Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via thCVE-2023-49489 · Other software · Kodcloud · reported by MITREMedium 6.1
Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.
- Product
- Kodexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6853 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugins/officeLive/app.php. The manipulation of the argument path leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The identifier of the patch is 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The identifier VDB-248221 was assigned to this vulnerability.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6852 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The name of the patch is 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248220.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability was found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6851 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is named 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248219.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2023A vulnerability was found in kalcaddle KodExplorer up to 4.51.03.CVE-2023-6850 · Other software · kalcaddle · reported by VulDBMedium 6.3
A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is identified as 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. VDB-248218 is the identifier assigned to this vulnerability.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page.CVE-2021-36646 · Other software · Kodcloud · reported by MITREMedium 6.1
A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page.
- Product
- Kodexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature.CVE-2023-37153 · Other software · Kodcloud · reported by MITREMedium 6.1
KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
- Product
- Kodexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2023A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49.CVE-2022-4944 · Other software · kalcaddle · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Kodexplorer is a chinese language web based file manager and browser based code editor.CVE-2022-46154 · Other software · kalcaddle · reported by GitHubHigh 8.6
Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.