Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
53 results · page 1 of 2
Oct 6, 2026The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filCVE-2026-106512 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.4
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an att
- Product
- sachertortephp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-92692 · Other software · sulu · reported by GitHubMedium 6.9
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths.CVE-2026-94379 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.9
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compro
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-baseCVE-2026-92932 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure
- Product
- sachertortephp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameterCVE-2024-58385 · Other software · Yonyou · reported by VulnCheckCritical 9.3
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
- Product
- U8 CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcn-sec.comsecurity.yonyou.com
Sep 8, 2026The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files.CVE-2026-78625 · Other software · Okta · reported by psirt@okta.comMedium 6.7
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.
- Product
- Okta Access Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82396 · Other software · sulu · reported by GitHubMedium 5.4
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82395 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-82394 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user whCVE-2026-71248 · Other software · Harsh21Patel · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.
- Product
- Inventory-Management-System-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file wiCVE-2026-35048 · Other software · Piwigo · reported by GitHubCritical 9.8
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-45701 · Other software · sulu · reported by GitHubMedium 6.9
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-34372 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature.CVE-2026-27174 · Other software · sergejey · reported by VulnCheckCritical 9.3
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
- Product
- MajorDoMo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Aug 25, 2025File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller.CVE-2025-52130 · Other software · reported by MITREMedium 5.4
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2025-47778 · Other software · sulu · reported by GitHubMedium 6.1
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content cCVE-2024-47946 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.2
If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data".
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Oct 3, 2024Sulu is a PHP content management system.CVE-2024-47618 · Other software · sulu · reported by GitHubMedium 5.1
Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Sulu is a PHP content management system.CVE-2024-47617 · Other software · sulu · reported by GitHubMedium 6.1
Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Sulu is a PHP content management system.CVE-2024-27915 · Other software · sulu · reported by GitHubMedium 6.8
Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Sulu is a highly extensible open-source PHP content management system based on the Symfony framework.CVE-2024-24807 · Other software · sulu · reported by GitHubLow 2.7
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones affected. The problem is patched with version(s) 2.4.16 and 2.5.12.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2023-39343 · Other software · sulu · reported by GitHubMedium 4.3
Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue. The vulnerability has been patched in version 2.5.10.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-43836 · Other software · sulu · reported by GitHubHigh 8.5
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-43835 · Other software · sulu · reported by GitHubHigh 7.2
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data.CVE-2021-43822 · Other software · jackalope · reported by GitHubHigh 8.5
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
- Product
- jackalope-doctrine-dbal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2021Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.phpCVE-2021-43617 · Other software · Laravel · reported by MITRECritical 9.8
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsalsa.debian.org
Oct 21, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-41169 · Other software · sulu · reported by GitHubMedium 6.2
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerabilityCVE-2021-38721 · Other software · Thedaylightstudio · reported by MITREMedium 6.5
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2021-32737 · Other software · sulu · reported by GitHubHigh 8.4
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2021OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.CVE-2020-36009 · Other software · Obottle Project · reported by MITREHigh 7.5
OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.
- Product
- Obottle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2021OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.CVE-2020-36008 · Other software · Obottle Project · reported by MITREHigh 8.1
OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.
- Product
- Obottle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.CVE-2020-24246 · Other software · Peplink · reported by MITREHigh 7.5
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- Product
- Balance 20x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.bssi.frdownload.peplink.com
Mar 2, 2020Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_adCVE-2018-19798 · Other software · Fleetco · reported by MITREHigh 8.8
Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_add.php?submit=1 URI, as demonstrated by the value_Images_1 field, which leads to remote command execution on the remote server. Any authenticated user can exploit this.
- Product
- Fleet Maintenance Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter.CVE-2019-3966 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter.CVE-2019-3965 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.CVE-2019-3964 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.CVE-2019-3963 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 1, 2019cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).CVE-2016-10851 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netforums.cpanel.net
Feb 26, 2019elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.CVE-2019-9194 · Other software · Std42 · reported by MITRECritical 9.8
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.CVE-2019-7543 · Other software · Kindsoft · reported by MITREMedium 6.1
In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
- Product
- Kindeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves iCVE-2019-7336 · Other software · Zoneminder · reported by MITREMedium 6.1
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2018The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safCVE-2015-9272 · WordPress plugins & themes · reported by MITRECritical 9.8
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
- Affected
- 3.31.17 to 3.31.17
- What to do
- Affects 3.31.17 to 3.31.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comopenwall.com
Aug 1, 2018rejucms 2.1 has stored XSS via the admin/book.php content parameter.CVE-2018-14838 · Other software · Rejucms Project · reported by MITREMedium 6.1
rejucms 2.1 has stored XSS via the admin/book.php content parameter.
- Product
- Rejucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.CVE-2018-5074 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
- Product
- Advanced Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2017The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enablesCVE-2017-5520 · Other software · Metalgenix · reported by MITREHigh 8.8
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` extensions.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 21, 2010Pointter PHP Content Management System 1.0 allows remote attackers to bypass authentication and obtain administrative privileges via arbitrary values of the ausCVE-2010-4332 · Other software · Pangramsoft · reported by MITREHigh 7.5
Pointter PHP Content Management System 1.0 allows remote attackers to bypass authentication and obtain administrative privileges via arbitrary values of the auser and apass cookies.
- Product
- Pointter PHP Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Oct 28, 2009Directory traversal vulnerability in include/processor.php in Greenwood PHP Content Manager 0.3.2 allows remote attackers to include and execute arbitrary localCVE-2009-3824 · Other software · Michael J Greenwood · reported by MITREHigh 7.5
Directory traversal vulnerability in include/processor.php in Greenwood PHP Content Manager 0.3.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content_path parameter.
- Product
- PHP Content Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexchange.xforce.ibmcloud.com
Aug 12, 2008Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors.CVE-2008-3654 · Other software · Tiki · reported by MITREMedium 5
Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfo.tikiwiki.orgtikiwiki.org
Nov 29, 2007Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a ..CVE-2007-6187 · Other software · Noah · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filepath parameter to (1) css_file.php, (2) js_file.php, or (3) xml_file.php in noah/modules/nosystem/templates/.
- Product
- Noah
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2007PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[CVE-2007-6177 · Email & office · PHP CON · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[APPPATH] parameter.
- Product
- PHP CON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.