Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Apr 27, 2026A weakness has been identified in dvladimirov MCP up to 0.1.0.CVE-2026-7211 · Other software · dvladimirov · reported by VulDBMedium 5.5
A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcp_server.py of the component Git Search API. Executing a manipulation of the argument repo_url/pattern can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A vulnerability was found in 666ghj MiroFish up to 0.1.2.CVE-2026-7059 · Other software · 666ghj · reported by VulDBMedium 5.5
A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function get_simulation_posts of the file backend/app/api/simulation.py of the component Query Parameter Handler. Performing a manipulation of the argument Platform results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- MiroFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A vulnerability has been found in 666ghj MiroFish up to 0.1.2.CVE-2026-7058 · Other software · 666ghj · reported by VulDBMedium 5.5
A vulnerability has been found in 666ghj MiroFish up to 0.1.2. The impacted element is the function SimulationIPCClient.send_command of the file backend/app/services/simulation_ipc.py of the component Inter-Process Communication. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MiroFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A flaw has been found in 666ghj MiroFish up to 0.1.2.CVE-2026-7042 · Other software · 666ghj · reported by VulDBMedium 5.5
A flaw has been found in 666ghj MiroFish up to 0.1.2. This affects the function create_app of the file backend/app/__init__.py of the component REST API Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MiroFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A vulnerability was detected in 666ghj MiroFish up to 0.1.2.CVE-2026-7041 · Other software · 666ghj · reported by VulDBLow 2.9
A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugger PIN Handler. Performing a manipulation of the argument SECRET results in information disclosure. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MiroFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application crCVE-2024-57375 · Other software · Andamiro · reported by MITRELow 2.4
Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application crash) via certain deselect actions.
- Product
- Pump It Up
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comxx.piugame.com
Feb 4, 2025Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.CVE-2025-22205 · Websites & servers · reported by security@joomla.orgHigh 7.5
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadmiror-design-studio.com
Dec 18, 2024A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.CVE-2024-56116 · Other software · Amiro · reported by MITREHigh 8.8
A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.
- Product
- Amiro.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements.CVE-2024-56115 · Other software · Amiro · reported by MITREMedium 6.1
A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It allows remote attackers to conduct a Cross-Site Scripting (XSS) attack.
- Product
- Amiro.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the serveCVE-2024-44734 · Other software · mirotalk · reported by MITREHigh 7.5
Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the server.
- Product
- mirotalk_p2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary code viCVE-2024-44731 · Other software · reported by MITREMedium 4.7
Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary code via sending crafted payloads in messages to other users over RTC connections.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arCVE-2024-44730 · Other software · mirotalk · reported by MITRECritical 9.1
Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.
- Product
- mirotalk_p2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to arCVE-2024-44729 · Other software · mirotalk · reported by MITREHigh 7.5
Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to arbitrarily eject users from a meeting.
- Product
- mirotalk_p2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used.CVE-2024-5737 · Other software · Nikola Vasilijevski · reported by cvd@cert.plMedium 6.3
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages availaCVE-2024-5736 · Other software · Nikola Vasilijevski · reported by cvd@cert.plHigh 8.2
Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root foCVE-2024-5735 · Other software · Nikola Vasilijevski · reported by cvd@cert.plMedium 6.3
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSCVE-2024-23746 · Other software · Miro · reported by MITRECritical 9.8
Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
- Product
- Miro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbook.hacktricks.xyzgithub.com
Aug 7, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla.CVE-2023-38045 · Other software · admiror-design-studio.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
- Product
- Admiror Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.CVE-2023-25473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 22, 2023A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2023-27054 · Other software · Mirotalk · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
- Product
- Mirotalk P2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could alCVE-2022-3084 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 7.8
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code.
- Product
- CIMPLICITY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2009Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the statuCVE-2009-3803 · Other software · Amirocms · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the status_message parameter to (1) /news, (2) /comment, (3) /forum, (4) /blog, and (5) /tags; the status_message parameter to (6) forum.php, (7) discussion.php, (8) guestbook.php, (9) blog.php, (10) news.php, (11) srv_updates.php, (12) srv_backups.php, (13) srv_twist_prevention.php, (14) srv_tags.php, (15) srv_tags_reindex.php, (16) google_sitemap.php, (17) sitemap_history.php, (18) srv_options.php, (19) locales.php and (20) plugins_wizard.php in _admin/; a crafted IMG BBcode tag in the message body of a (21) forum, (22) guestbook, or (23) comment; (24) the content of an avatar file, which is not properly handled by Internet Explorer; and (25) the loginname parameter (aka username) in _admin/index.php.
- Product
- Amiro.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Oct 27, 2009Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") to _admin/index.php, which reveals the inCVE-2009-3802 · Other software · Amirocms · reported by MITREMedium 5
Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") to _admin/index.php, which reveals the installation path and other information in an error message.
- Product
- Amiro.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Aug 11, 2009The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-cuCVE-2009-0687 · Other software · Midnightbsd · reported by cret@cert.orgHigh 7.8
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.
- Product
- Midnightbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orgftp.netbsd.org
Feb 25, 2009Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameCVE-2008-6287 · Other software · Getmiro · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to (1) MySQLController.php, (2) SQLController.php, (3) SetupController.php, (4) VideoController.php, and (5) ViewController.php in controllers/.
- Product
- Broadcast Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comvupen.com
Apr 16, 2008The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain CVE-2008-1845 · Other software · Mirbsd · reported by MITREHigh 7.2
The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option.
- Product
- Miros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2008The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory aCVE-2008-0984 · Other software · Miro · reported by MITREHigh 9.3
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.
- Product
- Miro Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Nov 14, 2007Cross-site scripting (XSS) vulnerability in login.php in Miro Project Broadcast Machine 0.9.9.9 allows remote attackers to inject arbitrary web script or HTML vCVE-2007-3694 · Other software · Getmiro · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in login.php in Miro Project Broadcast Machine 0.9.9.9 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
- Product
- Broadcast Machine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comint21.de
Jul 6, 2006PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHPCVE-2006-3396 · Other software · Miro International · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
- Product
- Galleria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.