Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Dec 10, 2025PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadCVE-2024-58284 · Other software · PopojiCMS · reported by VulnCheckHigh 8.6
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
- Product
- PopojiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.CVE-2023-50011 · Other software · Popojicms · reported by MITREHigh 7.2
PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 1, 2023A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic.CVE-2023-5910 · Other software · Popojicms · reported by VulDBLow 2.6
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.CVE-2022-47766 · Other software · Popojicms · reported by MITREHigh 8.8
PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.CVE-2021-28070 · Other software · Popojicms · reported by MITREMedium 4.3
Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.CVE-2020-19547 · Other software · Popojicms · reported by MITREMedium 6.5
Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.CVE-2020-18065 · Other software · Popojicms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML vCVE-2020-21357 · Other software · Popojicms · reported by MITREMedium 6.1
A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file CVE-2020-21356 · Other software · Popojicms · reported by MITREMedium 5.3
An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file uploads.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.CVE-2019-18816 · Other software · Popojicms · reported by MITREMedium 6.1
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019PopojiCMS 2.0.1 allows refer= Open Redirection.CVE-2019-18815 · Other software · Popojicms · reported by MITREMedium 6.1
PopojiCMS 2.0.1 allows refer= Open Redirection.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2019An issue was discovered in PopojiCMS v2.0.1.CVE-2019-9549 · Other software · Popojicms · reported by MITREHigh 8.8
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18936 · Other software · Popojicms · reported by MITREHigh 7.5
An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18935 · Other software · Popojicms · reported by MITREHigh 8.8
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2018An issue was discovered in PopojiCMS v2.0.1.CVE-2018-18934 · Other software · Popojicms · reported by MITRECritical 9.8
An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.