Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
213 results · page 1 of 5
Oct 12, 2026A flaw has been found in SEMCMS up to 5.0.CVE-2026-108814 · Other software · reported by VulDBLow 2.1
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A vulnerability was detected in SEMCMS up to 5.0.CVE-2026-108813 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A security vulnerability has been detected in SEMCMS up to 5.0.CVE-2026-108812 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A weakness has been identified in WMCMS 4.446.1257.CVE-2026-108811 · Other software · reported by VulDBLow 2.1
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026A weakness has been identified in YzmCMS up to 7.6.CVE-2026-105156 · Other software · reported by VulDBLow 2.9
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A flaw has been found in SEMCMS up to 4.2.CVE-2026-96739 · Other software · reported by VulDBLow 2.1
A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.CVE-2026-88416 · Other software · reported by MITRECritical 9.8
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS).CVE-2026-88415 · Other software · reported by MITREHigh 8.7
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).CVE-2026-88414 · Other software · reported by MITRECritical 9.8
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A SQL injection vulnerability was found in YzmCMS 7.5.CVE-2026-75417 · Other software · reported by MITREHigh 7.2
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.CVE-2026-68000 · Other software · reported by MITRECritical 9.8
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A security flaw has been discovered in MingSoft MCMS up to 3.0.6.CVE-2026-19357 · Other software · MingSoft · reported by VulDBMedium 5.5
A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was identified in MingSoft MCMS up to 3.0.6.CVE-2026-19356 · Other software · MingSoft · reported by VulDBMedium 5.5
A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in MingSoft MCMS up to 3.0.6.CVE-2026-19355 · Other software · MingSoft · reported by VulDBMedium 5.5
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.CVE-2026-52203 · Other software · reported by MITREHigh 7.5
An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026A security vulnerability has been detected in YzmCMS up to 7.5.CVE-2026-15202 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTP_HOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jun 29, 2026A vulnerability was determined in YzmCMS up to 7.5.CVE-2026-13529 · Other software · reported by VulDBLow 2.9
A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of the argument siteurl can lead to sql injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.CVE-2026-39170 · Other software · reported by MITREMedium 6.3
SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.CVE-2026-39169 · Other software · reported by MITREHigh 7.5
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 27, 2026A security vulnerability has been detected in mingSoft MCMS up to 5.5.0.CVE-2026-4954 · Other software · mingSoft · reported by VulDBLow 2.1
A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A weakness has been identified in mingSoft MCMS up to 5.5.0.CVE-2026-4953 · Other software · mingSoft · reported by VulDBMedium 5.5
A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the cCVE-2026-29933 · Other software · Yzmcms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A flaw has been found in mingSoft MCMS 6.1.1.CVE-2026-2666 · Other software · mingSoft · reported by VulDBLow 2
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026A security vulnerability has been detected in SEMCMS 5.0.CVE-2026-1552 · Other software · Sem-cms · reported by VulDBLow 2.1
A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crCVE-2025-60837 · Other software · Mingsoft · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Oct 17, 2025A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL quCVE-2025-56316 · Other software · Mingsoft · reported by MITRECritical 9.8
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 10, 2025An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2025-60838 · Other software · Mingsoft · reported by MITREMedium 6.5
An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Sep 30, 2025An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historicalCVE-2025-55797 · Other software · Formcms · reported by MITREMedium 6.5
An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.
- Product
- Formcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.CVE-2025-56304 · Other software · Yzmcms · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.CVE-2025-55835 · Other software · Sueamcms Project · reported by MITRECritical 9.8
File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.
- Product
- Sueamcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London.CVE-2025-41000 · Other software · BoomCMS · reported by cve-coordination@incibe.esLow 2.1
Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
- Product
- BoomCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature.CVE-2025-56236 · Other software · Formcms · reported by MITREMedium 6.1
FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.
- Product
- Formcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.CVE-2025-51660 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.CVE-2025-51659 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.CVE-2025-51658 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.CVE-2025-51657 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.CVE-2025-51656 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.CVE-2025-51655 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.CVE-2025-51654 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.CVE-2025-51653 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.CVE-2025-51652 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2025-29287 · Other software · Mingsoft · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Apr 7, 2025A vulnerability classified as problematic has been found in YzmCMS 7.1.CVE-2025-3397 · Other software · Yzmcms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.CVE-2025-25686 · Other software · Sem-cms · reported by MITRECritical 9.8
semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.CVE-2024-13193 · Other software · Sem-cms · reported by VulDBMedium 5.3
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.CVE-2024-53502 · Other software · Sem-cms · reported by MITRELow 3.8
Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024SemCms v4.8 was discovered to contain a SQL injection vulnerability.CVE-2024-52725 · Other software · Sem-cms · reported by MITREMedium 4.9
SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.CVE-2024-46103 · Other software · sem-cms · reported by MITRECritical 9.8
SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.CVE-2024-42991 · Other software · mingsoft · reported by MITREHigh 8.1
MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
- Product
- mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21.CVE-2024-43006 · Other software · zzcms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information.
- Product
- zzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.