Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
May 12, 2026An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado paramCVE-2023-30059 · Other software · reported by MITREMedium 5.4
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.CVE-2023-27753 · Other software · reported by MITREHigh 8
An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess filCVE-2023-27246 · Other software · Mk-auth · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2021MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.CVE-2021-21495 · Other software · Mk-auth · reported by MITREHigh 8.8
MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jan 3, 2021MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter.CVE-2021-21494 · Other software · Mk-auth · reported by MITREMedium 4.8
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jan 2, 2021MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the CVE-2021-3005 · Other software · Mk-auth · reported by MITREMedium 4.3
MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jun 29, 2020An issue was discovered in MK-AUTH 19.01.CVE-2020-14072 · Other software · Mk-auth · reported by MITRECritical 9.8
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jun 29, 2020An issue was discovered in MK-AUTH 19.01.CVE-2020-14071 · Other software · Mk-auth · reported by MITREMedium 6.1
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jun 29, 2020An issue was discovered in MK-AUTH 19.01.CVE-2020-14070 · Other software · Mk-auth · reported by MITRECritical 9.8
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executar_login.php result in admin access.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jun 29, 2020An issue was discovered in MK-AUTH 19.01.CVE-2020-14069 · Other software · Mk-auth · reported by MITREMedium 6.8
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Jun 29, 2020An issue was discovered in MK-AUTH 19.01.CVE-2020-14068 · Other software · Mk-auth · reported by MITRECritical 9.8
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executar_login.php.
- Product
- Mk-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmk-auth.com.brgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.