Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Sep 28, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause ofCVE-2026-100752 · Other software · ordasoft.com · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.
- Product
- Real Estate Manager (Free) extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.CVE-2026-57871 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 7.1
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without auCVE-2026-57870 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auMedium 5.3
Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uCVE-2026-57869 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 7.1
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.CVE-2026-57868 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 7.1
MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management.CVE-2026-57867 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 8.8
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Mar 12, 2026Inout RealEstate contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the CVE-2019-25479 · Other software · Inoutscripts · reported by VulnCheckHigh 8.8
Inout RealEstate contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the city parameter. Attackers can send POST requests to the agents/agentlistdetails endpoint with malicious SQL payloads in the city parameter to extract sensitive database information.
- Product
- Inout RealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Apr 1, 2025The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26.CVE-2025-2237 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
- Affected
- up to 1.6.26
- What to do
- Affects up to 1.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jul 10, 2022The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31574 · Other software · Realestate Project · reported by MITRECritical 9.3
The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Realestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.CVE-2017-17909 · Other software · Responsive Realestate Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
- Product
- Responsive Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.CVE-2017-17908 · Other software · Responsive Realestate Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
- Product
- Responsive Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.CVE-2017-17628 · Other software · Responsive Realestate Script Project · reported by MITRECritical 9.8
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
- Product
- Responsive Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.CVE-2017-17591 · Other software · Realestate Crowdfunding Script Project · reported by MITRECritical 9.8
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
- Product
- Realestate Crowdfunding Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 21, 2014The Go MSX MLS (aka com.doapps.android.realestate.RE_16b9c09c4d5b0e174208f35e7c49f9a0) application 2.3.4.MR3 for Android does not verify X.509 certificates fromCVE-2014-7644 · Other software · Doapps · reported by cret@cert.orgMedium 5.4
The Go MSX MLS (aka com.doapps.android.realestate.RE_16b9c09c4d5b0e174208f35e7c49f9a0) application 2.3.4.MR3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- GO MSX MLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 4, 2012Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid parameter to listings.phpCVE-2012-5290 · Other software · Wcs4web · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid parameter to listings.php or (2) infoid parameter to index.php.
- Product
- Easywebrealestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexchange.xforce.ibmcloud.com
Dec 14, 2011Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commandsCVE-2011-4823 · Other software · Extensionsforjoomla · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.
- Product
- COM Vikrealestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.joomla.orgexploit-db.com
Jun 21, 2010SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parametCVE-2010-2357 · Other software · Eicrasoft · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parameter. NOTE: some of these details are obtained from third party information.
- Product
- Eicra Realestate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2010SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands viaCVE-2009-4613 · Other software · Netartmedia · reported by MITREHigh 7.5
SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Real Estate Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2010SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands viaCVE-2009-4600 · Other software · Netartmedia · reported by MITREHigh 7.5
SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Email parameter (aka the username field). NOTE: some of these details are obtained from third party information.
- Product
- Media Real Estate Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2009Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang pCVE-2009-4318 · Other software · Realestatephp · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. NOTE: some of these details are obtained from third party information.
- Product
- Real Estate Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jul 28, 2009PHP remote file inclusion vulnerability in toolbar_ext.php in the RealEstateManager (com_realestatemanager) component 1.0 Basic for Joomla! allows remote attackCVE-2009-2635 · Other software · Ordasoft · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in toolbar_ext.php in the RealEstateManager (com_realestatemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
- Product
- COM Realestatemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 22, 2008SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands via the cat_CVE-2008-4674 · Other software · Conkurent · reported by MITREMedium 6.8
SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in browse mode.
- Product
- Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
May 27, 2008SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.CVE-2008-2443 · Other software · Therealestatescript · reported by MITREHigh 7.5
SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.
- Product
- The Real Estate Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Nov 14, 2006SQL injection vulnerability in propertysdetails.asp in Dynamic Dataworx NuRealestate (NuRems) 1.0 and earlier allows remote attackers to execute arbitrary SQL cCVE-2006-5886 · Other software · Dynamic Dataworx · reported by MITREHigh 7.5
SQL injection vulnerability in propertysdetails.asp in Dynamic Dataworx NuRealestate (NuRems) 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the PropID parameter.
- Product
- Nurealestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Mar 28, 2006Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in realestateZONE 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1)CVE-2006-1486 · Other software · Fusionzone · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in realestateZONE 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) bamin, (2) bemin, (3) pmin, and (4) state parameters.
- Product
- Realestatezone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpridels0.blogspot.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.