Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
70 results · page 1 of 2
Oct 28, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-116778 · Other software · FOGProject · reported by GitHubHigh 8.8
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-54554 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=iCVE-2026-74571 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs(). [CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fs_i
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47689 · Other software · FOGProject · reported by GitHubMedium 4.6
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47688 · Other software · FOGProject · reported by GitHubHigh 8.2
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47687 · Other software · FOGProject · reported by GitHubHigh 7.3
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47685 · Other software · FOGProject · reported by GitHubHigh 7.3
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62110 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 3.3.
- Product
- Rescue Shortcodes
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-33739 · Other software · FOGProject · reported by GitHubMedium 5.7
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) are vulnerable to Stored Cross-Site Scripting (XSS), due to insufficient server-side parameter sanitization in record creations/updates and a lack of HTML escaping in listing tables. Version 1.5.10.1812 patches the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-24138 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2025-58443 · Other software · FOGProject · reported by GitHubCritical 9.9
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate priCVE-2025-1700 · Other software · Motorola · reported by psirt@lenovo.comHigh 7.1
A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.
- Product
- Software Fix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comsupport.lenovo.com
Jul 9, 2025In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based CVE-2025-38260 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) DEBUG: rescue=ibadroots parsed BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by repro (1010) BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm BTRFS info (device loop0): using free-space-tree BTRFS warning (device loop0): checksum verify failed on logical 5312512 mirror 1 wanted 0xb043382657aede36608fd3386d6b001692ff406164733d94e2d9a180412c6003 found 0x810ceb2bacb7f0f9eb2bf3b2b15c02af867cb35ad450898169f3b1f0bd818651 level 0 DEBUG: read tree root path failed for tree csum, ret=-5 BTRFS warning (device loop0): checksum verify failed on logical 5328896 mirror 1 wanted 0x51be4e8b303da58e6340226815b70e3a93592dac3f30dd510c7517454de8567a found 0x51be4e8b303da58e634022a315b70e3a93592dac3f30dd510c7517454de8567a level 0 BTRFS warning (device loop0): check
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 16, 2025Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39528 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes rescue-shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through <= 3.1.
- Product
- Rescue Shortcodes
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("CVE-2025-21786 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the normal workers but mistakenly does not handle the rescuer and also removes the code waiting for the rescuer in put_unbound_pool(), which caused a use-after-free bug reported by Cheung Wall. To avoid the use-after-free bug, the pool’s reference must be held until the detachment is complete. Therefore, move the code that puts the pwq after detaching the rescuer from the pool.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 23, 2024Rescue Shortcodes: Stored Cross-Site ScriptingCVE-2024-11199 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rescue_progressbar shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Rescue Shortcodes
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2024In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check.CVE-2024-47026 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2024Rescue Shortcodes: Stored Cross-Site ScriptingCVE-2024-9696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Rescue Shortcodes
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 2, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-42349 · Other software · FOGProject · reported by GitHubMedium 5.3
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_login_accepted.log and fog_login_failed.log), exposing the name of the user account used to manage FOG, the IP address of the computer used to login and the User-Agent. This vulnerability is fixed in 1.5.10.47.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-42348 · Other software · FOGProject · reported by GitHubCritical 9.3
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-41954 · Other software · FOGProject · reported by GitHubMedium 5.3
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2024-41108 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" will be returned. The domainpassword in the hostinfo dump is hidden even to authenticated users, as it is displayed as a row of asterisks when navigating to the host's Active Directory settings. This vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-40645 · Other software · FOGProject · reported by GitHubHigh 8.8
FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse. This vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2024-39916 · Other software · FOGProject · reported by GitHubMedium 6.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-39914 · Other software · FOGProject · reported by GitHubCritical 9.8
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affCVE-2024-20282 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a sensitive access token. An attacker could exploit this vulnerability by using this token to access resources within the device infrastructure. A successful exploit could allow an attacker to gain root access to the filesystem or hosted containers on an affected device.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 12, 2024Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y.CVE-2024-23301 · Other software · Relax-and-recover · reported by MITREMedium 5.5
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
- Product
- Relax-and-recover
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later.CVE-2023-50724 · Other software · resque · reported by GitHubMedium 6.3
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
- Product
- resque
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46237 · Other software · FOGProject · reported by GitHubMedium 5.8
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46236 · Other software · FOGProject · reported by GitHubHigh 8.6
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46235 · Other software · FOGProject · reported by GitHubMedium 5.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41728 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
- Product
- Rescue Shortcodes
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 17, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.CVE-2022-31941 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.CVE-2022-31965 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.CVE-2022-31964 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.CVE-2022-31962 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.CVE-2022-31961 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.CVE-2022-31959 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.CVE-2022-31957 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.CVE-2022-31956 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.CVE-2022-31953 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.CVE-2022-31952 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.CVE-2022-31951 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.CVE-2022-31948 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.CVE-2022-31946 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.8
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.CVE-2022-31945 · Other software · Rescue Dispatch Management System Project · reported by MITRECritical 9.1
Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.CVE-2022-30017 · Other software · Rescue Dispatch Management System Project · reported by MITREMedium 5.4
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 23, 2022Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.CVE-2022-30016 · Other software · Rescue Dispatch Management System Project · reported by MITREHigh 8.8
Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 13, 2015CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.CVE-2015-2962 · Other software · CGI Rescue · reported by vultures@jpcert.or.jpHigh 7.5
CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
- Product
- Blobee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2014The Wonder Zoo - Animal rescue ! (aka com.gameloft.android.ANMP.GloftZRHM) application 1.6.1 for Android does not verify X.509 certificates from SSL servers, whCVE-2014-5628 · Other software · Gameloft · reported by cret@cert.orgMedium 5.4
The Wonder Zoo - Animal rescue ! (aka com.gameloft.android.ANMP.GloftZRHM) application 1.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wonder ZOO - Animal Rescue !
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.