Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 17, 2026The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability.CVE-2026-93468 · Other software · HGiga · reported by twcert@cert.org.twHigh 8.7
The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.
- Product
- OAKlouds-bulletin_v3-2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 17, 2026The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability.CVE-2026-93467 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.3
The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- Product
- OAKlouds-custom_page-2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 14, 2024The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk.CVE-2024-9924 · Other software · Hgiga · reported by twcert@cert.org.twCritical 9.8
The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently .
- Product
- OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 14, 2024The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability.CVE-2024-26261 · Other software · Hgiga · reported by twcert@cert.org.twCritical 9.8
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
- Product
- OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Feb 14, 2024The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system CVE-2024-26260 · Other software · Hgiga · reported by twcert@cert.org.twCritical 9.8
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
- Product
- OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Mar 27, 2023HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type.CVE-2023-25909 · Other software · HGIGA INC. · reported by twcert@cert.org.twCritical 9.8
HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.
- Product
- HGiga OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 30, 2022OAKlouds Portal website’s Meeting Room has insufficient validation for user input.CVE-2022-38118 · Other software · HGiga · reported by twcert@cert.org.twHigh 8.8
OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.
- Product
- OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Sep 15, 2021The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page.CVE-2021-37913 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
- Product
- OAKlouds OAKSv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 15, 2021The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page.CVE-2021-37912 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
- Product
- OAKlouds OAKSv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 19, 2021HGiga EIP product contains SQL Injection vulnerability.CVE-2021-22852 · Other software · HGiga · reported by twcert@cert.org.twHigh 8.8
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
- Product
- OAKSv20 OAKlouds-mol_course_v3 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jan 19, 2021HGiga EIP product contains SQL Injection vulnerability.CVE-2021-22851 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
- Product
- OAKSv20 OAKlouds-document_v3 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jan 19, 2021HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.CVE-2021-22850 · Other software · HGiga · reported by twcert@cert.org.twMedium 5.3
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
- Product
- OAKSv20 OAKlouds-document_v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jun 3, 2019Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability.CVE-2019-9883 · Other software · OAKlouds · reported by twcert@cert.org.twHigh 8.8
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
- Product
- MailSherlock MSR35
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsurl.twcert.org.twtvn.twcert.org.tw
Jun 3, 2019Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability.CVE-2019-9882 · Other software · OAKlouds · reported by twcert@cert.org.twHigh 8.8
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
- Product
- MailSherlock MSR35
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsurl.twcert.org.twtvn.twcert.org.tw
Feb 11, 2019SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the CVE-2018-17542 · Other software · OAKlouds · reported by twcert@cert.org.twMedium 4.3
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.
- Product
- MailSherlock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.