Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Dec 17, 2025A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_languagCVE-2025-67174 · Other software · Ritecms · reported by MITREHigh 7.5
A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST requCVE-2025-67173 · Other software · Ritecms · reported by MITREMedium 6.8
A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.CVE-2025-67171 · Other software · Ritecms · reported by MITREHigh 7.5
Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a craftCVE-2025-67170 · Other software · Ritecms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.CVE-2025-67168 · Other software · Ritecms · reported by MITREMedium 5.3
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.CVE-2025-67172 · Other software · Ritecms · reported by MITREHigh 7.2
RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.CVE-2024-28623 · Other software · ritecms · reported by MITREMedium 6.1
RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.
- Product
- ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.CVE-2023-44767 · Other software · Ritecms · reported by MITREMedium 4.8
A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fieldCVE-2023-43877 · Other software · Ritecms · reported by MITREMedium 4.8
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content BlocksCVE-2023-43879 · Other software · ritecms · reported by MITREMedium 4.8
Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu.
- Product
- ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu IteCVE-2023-43878 · Other software · Ritecms · reported by MITREMedium 5.4
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel.CVE-2022-24248 · Other software · Ritecms · reported by MITREMedium 6.5
RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.0day.todayexploit-db.com
Apr 12, 2022RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel.CVE-2022-24247 · Other software · Ritecms · reported by MITREMedium 6.5
RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write) resulting a remote code execution.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexploit-db.com
Apr 8, 2022RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel.CVE-2021-46367 · Other software · Ritecms · reported by MITREHigh 7.2
RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.compacketstormsecurity.com
Aug 18, 2020An issue was discovered in RiteCMS 2.2.1.CVE-2020-23934 · Other software · Ritecms · reported by MITREHigh 8.8
An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 20, 2013Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the mode parameter to cmsCVE-2013-5317 · Other software · Ritecms · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the mode parameter to cms/index.php.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 20, 2013Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for requests that changeCVE-2013-5316 · Other software · Ritecms · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via an edit user action to cms/index.php.
- Product
- Ritecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.