Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
324new WordPress flaws this week
390,007entries in the database

10 results

  • May 15, 2025SAP NetWeaver Deserialization VulnerabilityCVE-2025-42999 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 9.1

    SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

    Product
    NetWeaver
    On CISA’s list since
    May 15, 2025 (federal fix deadline Jun 5, 2025)
    What to do
    Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogme.sap.comurl.sap

  • Apr 29, 2025SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2025-31324 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 10

    SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

    Product
    NetWeaver
    On CISA’s list since
    Apr 29, 2025 (federal fix deadline May 20, 2025)
    What to do
    Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogme.sap.comurl.sap

  • Mar 19, 2025SAP NetWeaver Directory Traversal VulnerabilityCVE-2017-12637 · Network & remote access · SAP · reported by MITREExploitedHigh 7.5

    SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.

    Product
    NetWeaver
    On CISA’s list since
    Mar 19, 2025 (federal fix deadline Apr 9, 2025)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogweb.archive.orgcisa.gov

  • Jun 9, 2022SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2021-38163 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 9.9

    SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

    Product
    NetWeaver
    On CISA’s list since
    Jun 9, 2022 (federal fix deadline Jun 30, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloglaunchpad.support.sap.comwiki.scn.sap.com

  • Jun 9, 2022SAP NetWeaver Information Disclosure VulnerabilityCVE-2016-2388 · Network & remote access · SAP · reported by MITREExploitedMedium 5.3

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

    Product
    NetWeaver
    On CISA’s list since
    Jun 9, 2022 (federal fix deadline Jun 30, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

  • Jun 9, 2022SAP NetWeaver SQL Injection VulnerabilityCVE-2016-2386 · Network & remote access · SAP · reported by MITREExploitedCritical 9.8

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Product
    NetWeaver
    On CISA’s list since
    Jun 9, 2022 (federal fix deadline Jun 30, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comseclists.org

  • Nov 3, 2021SAP NetWeaver Directory Traversal VulnerabilityCVE-2016-3976 · Network & remote access · SAP · reported by MITREExploitedHigh 7.5

    SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.

    Product
    NetWeaver
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comseclists.org

  • Nov 3, 2021SAP NetWeaver XML External Entity (XXE) VulnerabilityCVE-2016-9563 · Network & remote access · SAP · reported by MITREExploitedMedium 6.5

    SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.

    Product
    NetWeaver
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogsecurityfocus.comerpscan.io

  • Nov 3, 2021SAP NetWeaver Missing Authentication for Critical Function VulnerabilityCVE-2020-6287 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 10

    SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.

    Product
    NetWeaver
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comseclists.org

  • Nov 3, 2021SAP NetWeaver Remote Code Execution VulnerabilityCVE-2010-5326 · Network & remote access · SAP · reported by MITREExploitedCritical 10

    SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.

    Product
    NetWeaver
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogservice.sap.comonapsis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.