Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Jun 20, 2023SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.CVE-2020-21400 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.CVE-2020-21060 · Websites & servers · Phpmywind · reported by MITREHigh 8.8
SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authenticCVE-2020-19964 · Websites & servers · Phpmywind · reported by MITREMedium 6.5
A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021PHPMyWind 5.6 is vulnerable to Remote Code Execution.CVE-2021-39503 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2021Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.CVE-2020-18886 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2021Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.CVE-2020-18885 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
May 27, 2021Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of compCVE-2020-18230 · Websites & servers · Phpmywind · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php".
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of compoCVE-2020-18229 · Websites & servers · Phpmywind · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php".
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2019admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.CVE-2019-16704 · Websites & servers · Phpmywind · reported by MITREMedium 4.8
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2019admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.CVE-2019-16703 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019An issue was discovered in PHPMyWind 5.5.CVE-2019-7661 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019An issue was discovered in PHPMyWind 5.5.CVE-2019-7660 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demonstrated by admin/login.php.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.CVE-2019-8435 · Websites & servers · Phpmywind · reported by MITREMedium 4.8
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2019An issue was discovered in PHPMyWind 5.5.CVE-2019-7403 · Websites & servers · Phpmywind · reported by MITREMedium 4.9
An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&tbname=../ URI.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2019An issue was discovered in PHPMyWind 5.5.CVE-2019-7402 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via CSRF.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.CVE-2018-17134 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.CVE-2018-17133 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.CVE-2018-17132 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.CVE-2018-17131 · Websites & servers · Phpmywind · reported by MITREHigh 7.2
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2018PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,CVE-2018-17130 · Websites & servers · Phpmywind · reported by MITREMedium 5.4
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2018PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.CVE-2018-11487 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2017PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.CVE-2017-12984 · Websites & servers · Phpmywind · reported by MITREMedium 6.1
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.
- Product
- Phpmywind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyuag.orgexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.