Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

23 results

Feb 17, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising ServiCVE-2025-8303 · Other software · EKA Software Computer Information Advertising Services Ltd. · reported by iletisim@usom.gov.trMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 (With Doping Module – Store Module – New Language System) allows Cross-Site Scripting (XSS). This issue affects Real Estate Script V5 (With Doping Module – Store Module – New Language System): through 17022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Real Estate Script V5 (With Doping Module – Store Module – New Language System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jul 16, 2022A vulnerability was found in Itech Real Estate Script 3.12.CVE-2017-20130 · Other software · Itech · reported by VulDBMedium 6.3
A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Product
Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com exploit-db.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.CVE-2019-20337 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 7.2
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 5, 2020In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.CVE-2019-20336 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.1
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.CVE-2018-15189 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 5.4
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in theCVE-2018-15188 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.5
PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in the Name field of a profile.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Aug 10, 2018PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.CVE-2018-15187 · Other software · Advanced Real Estate Script Project · reported by MITREHigh 8
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.CVE-2018-5078 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.CVE-2018-5077 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.CVE-2018-5076 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.CVE-2018-5075 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.CVE-2018-5074 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has CSRF via admin/movieedit.php.CVE-2018-5073 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 6.8
Online Ticket Booking has CSRF via admin/movieedit.php.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2018Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.CVE-2018-5072 · Other software · Advanced Real Estate Script Project · reported by MITREMedium 4.8
Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 13, 2017Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.CVE-2017-17603 · Other software · Advanced Real Estate Script Project · reported by MITRECritical 9.8
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.
Product
Advanced Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Oct 31, 2017Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searcCVE-2017-15991 · Other software · Vastal · reported by MITRECritical 9.8
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Feb 2, 2012SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands viaCVE-2012-0982 · Other software · Vastal · reported by MITREHigh 7.5
SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Sep 30, 2009SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commanCVE-2009-3497 · Other software · Vastal · reported by MITREHigh 7.5
SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com packetstormsecurity.org
Jun 1, 2009Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.CVE-2008-6818 · Other software · Mole-group · reported by MITREMedium 5
Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Sep 10, 2008SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands vCVE-2008-3951 · Other software · Vastal · reported by MITREHigh 7.5
SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the ann_id parameter.
Product
Agent Zone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Jul 10, 2008SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the listCVE-2008-3123 · Other software · Mole Group · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the listing_id parameter in a listings action.
Product
Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
May 27, 2008SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.CVE-2008-2443 · Other software · Therealestatescript · reported by MITREHigh 7.5
SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.
Product
The Real Estate Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Dec 19, 2007Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in PHP Real Estate Classifieds allow remote attackers to inject arbitrary web script or HCVE-2007-6463 · Websites & servers · PHP Real Estate Script · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in PHP Real Estate Classifieds allow remote attackers to inject arbitrary web script or HTML via unspecified "text areas/boxes."
Product
Classifieds
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org phprealestatescript.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.