Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 1 of 2
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In CVE-2026-98839 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count. Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted. When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer. Fix this by terminating the loop when pasted >= vc_sel.buf_len. Kernel stack trace (Linux 7.3.0-rc3): ================================================================== BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650 Read of size 4094 at addr ffff888101c58010 by ta
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 23, 2026Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.CVE-2026-93527 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2026Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.CVE-2026-92030 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 14, 2026An access issue was addressed with additional sandbox restrictions on the system pasteboards.CVE-2026-84569 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape CVE-2026-90774 · Other software · orhun · reported by VulnCheckHigh 8.7
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
- Product
- rustypaste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the NodCVE-2026-86712 · Other software · siyuan-note · reported by VulnCheckHigh 8.6
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2026-55891 · Other software · PrivateBin · reported by GitHubNone
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in versi
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2026-55696 · Other software · PrivateBin · reported by GitHubMedium 4.3
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path.CVE-2026-73102 · Other software · rustdesk · reported by VulnCheckMedium 6.9
RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.
- Product
- rustdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Other issue in the DOM: Copy & Paste and Drag & Drop component.CVE-2026-16378 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 26, 2026Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-63079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2026-50882 · Other software · reported by MITREHigh 7.5
An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 13, 2026Spoofing issue in the DOM: Copy & Paste and Drag & Drop component.CVE-2026-0890 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 13, 2025Doubly – Cross Domain Copy Paste for: PHP Object InjectionCVE-2025-14476 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access.
- Product
- Doubly – Cross Domain Copy Paste for
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Doubly – Cross Domain Copy Paste for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 16, 2025TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability.CVE-2025-13283 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twHigh 7
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes.
- Product
- TenderDocTransfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 13, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64714 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64711 · Other software · PrivateBin · reported by GitHubLow 3.9
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session (self-XSS). This allows an attacker who can entice a victim to drag or otherwise attach such a file to exfiltrate plaintext, encryption keys, or stored pastes before they are encrypted or sent. Certain conditions must exist for the vulnerability to be exploitable. Only macOS or Linux users are affected, due to the way the `>` character is treated in a file name on Windows. The PrivateBin instance needs to have file upload enabled. An attacker needs to have access to the local file system or somehow convince the user to create (or download) a malicious file (name). An attacker needs to convince the user to attach that malicious file to PrivateBin. Any Mac / Linux user who can be tricked into dragging a maliciously named file into the editor is impacted; code runs in the origin of the PrivateBin instance they are using. Attackers
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-62796 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind).CVE-2025-53104 · Other software · gluestack · reported by GitHubCritical 9.1
gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner. This issue has been fixed in commit e6b4271 where the discussion-to-slack.yml workflow was removed. Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository.
- Product
- gluestack-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025An access issue was addressed with additional sandbox restrictions on the system pasteboards.CVE-2025-30461 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Feb 27, 2025The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text iCVE-2025-1692 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 6.3
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
- Product
- mongosh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Pastebin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23908 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rami Yushuvaev Pastebin pastebin-embed allows Stored XSS.This issue affects Pastebin: from n/a through <= 1.5.
- Product
- Pastebin
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Pastebin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.CVE-2024-36624 · Other software · Zulip · reported by MITREMedium 5.4
Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.
- Product
- Zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 29, 2024A clipboard "paste" button could persist across tabs which allowed a spoofing attack.CVE-2024-10465 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 9, 2024PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2024-39899 · Other software · PrivateBin · reported by GitHubMedium 5.3
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023dpaste is an open source pastebin application written in Python using the Django framework.CVE-2023-49277 · Other software · DarrenOfficial · reported by GitHubHigh 8.3
dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
- Product
- dpaste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2023DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in theCVE-2023-2318 · Other software · MarkText · reported by info@starlabs.sgHigh 8.6
DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.
- Product
- MarkText
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into CVE-2022-21948 · Other software · openSUSE · reported by meissner@suse.deMedium 4.3
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions.
- Product
- paste
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Dec 30, 2022A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic.CVE-2018-25059 · Other software · Pastebinit Project · reported by VulDBLow 3.5
A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 is able to address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
- Product
- Pastebinit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.CVE-2022-37290 · Other software · Gnome · reported by MITREMedium 5.5
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
- Product
- Nautilus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
Apr 11, 2022PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data.CVE-2022-24833 · Other software · PrivateBin · reported by GitHubHigh 8.2
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.CVE-2021-45257 · Other software · Nasm · reported by MITREMedium 5.5
An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Sep 14, 2021In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page.CVE-2021-32202 · Other software · Cs-cart · reported by MITREMedium 6.1
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page.
- Product
- Cs-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.CVE-2021-40147 · Other software · Emtec · reported by MITRECritical 9.8
EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.
- Product
- ZOC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2021NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.CVE-2021-37326 · Other software · Netsarang · reported by MITREMedium 5.3
NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.
- Product
- Xshell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsarang.comnetsarang.com
Aug 12, 2021@github/paste-markdown is an npm package for pasting markdown objects.CVE-2021-37700 · Other software · github · reported by GitHubMedium 6.5
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
- Product
- paste-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connecCVE-2020-23284 · Other software · MV · reported by MITREHigh 7.5
Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connect into the database which reveals internal and sensitive information without logging into the web application.
- Product
- Idce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2021Mintty before 3.4.7 mishandles Bracketed Paste Mode.CVE-2021-31701 · Other software · Mintty Project · reported by MITREHigh 7.5
Mintty before 3.4.7 mishandles Bracketed Paste Mode.
- Product
- Mintty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2021The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied messCVE-2021-30496 · Other software · telegram · reported by MITREMedium 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
- Product
- telegram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then preCVE-2021-26272 · Other software · Ckeditor · reported by MITREMedium 6.5
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
- Product
- Ckeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Jan 26, 2021It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialCVE-2021-26271 · Other software · Ckeditor · reported by MITREMedium 6.5
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
- Product
- Ckeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Dec 23, 2020URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain cirCVE-2020-6159 · Computers, phones & browsers · Opera · reported by security@opera.comMedium 6.1
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
- Product
- Opera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.opera.comsecurity.opera.com
Oct 2, 2020Froala Editor before 3.2.2 allows XSS via pasted content.CVE-2020-26523 · Other software · Froala · reported by MITREMedium 6.1
Froala Editor before 3.2.2 allows XSS via pasted content.
- Product
- Froala Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert cCVE-2020-17480 · Other software · Tiny · reported by MITREMedium 6.1
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
- Product
- Tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2020Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-CVE-2020-10458 · Other software · Chadhaajay · reported by MITREMedium 6.5
Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence (../) via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a doCVE-2020-10457 · Other software · Chadhaajay · reported by MITRELow 2.7
Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence (../) via the POST parameter imgName (for the new name) and imgUrl (for the current file to be renamed).
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itantoniocannito.it
Mar 12, 2020admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the aCVE-2020-10386 · Other software · Chadhaajay · reported by MITREHigh 7.2
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory.
- Product
- Phpkb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantoniocannito.itpacketstormsecurity.com
Feb 11, 2020The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which maCVE-2013-2213 · Other software · KDE · reported by Red HatMedium 5.5
The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output.
- Product
- Paste Applet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 11, 2020The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allowCVE-2013-2120 · Other software · KDE · reported by Red HatHigh 8.4
The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack.
- Product
- Paste Applet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comopenwall.com
Dec 10, 2019The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.CVE-2019-19708 · Other software · Mediawiki · reported by MITREMedium 6.1
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
- Product
- Visual Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.