Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
73 results · page 1 of 2
Oct 8, 2025File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform.CVE-2025-10353 · Other software · Melis Technology · reported by cve-coordination@incibe.esCritical 9.3
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
- Product
- Melis Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology.CVE-2025-10351 · Other software · Melis Technology · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
- Product
- Melis Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2024S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.CVE-2023-29962 · Other software · S-cms · reported by MITREMedium 6.5
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 31, 2023A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7191 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7190 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 31, 2023A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006.CVE-2023-7189 · Other software · S-cms · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.CVE-2023-51052 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.CVE-2023-51051 · Other software · s-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.
- Product
- s-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.CVE-2023-51050 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.CVE-2023-51049 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.CVE-2023-51048 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() functionCVE-2020-20636 · Other software · Joyplus-cms Project · reported by MITREHigh 7.5
SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function.
- Product
- Joyplus-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.CVE-2023-29963 · Other software · S-cms · reported by MITREHigh 7.2
S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022A vulnerability was found in S-CMS 5.0 Build 20220328.CVE-2022-4377 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability.
- Product
- S-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools.CVE-2022-39297 · Other software · melisplatform · reported by GitHubHigh 7.7
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
- Product
- melis-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.CVE-2022-23336 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Dec 22, 2021S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.CVE-2020-20426 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.CVE-2020-20425 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.CVE-2020-19954 · Other software · S-cms · reported by MITREHigh 7.5
An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0.CVE-2021-37270 · Other software · S-cms · reported by MITRECritical 9.8
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority.
- Product
- CMS Enterprise Website Construction System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the componentCVE-2020-19158 · Other software · S-cms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.CVE-2020-20340 · Other software · S-cms · reported by MITREHigh 7.5
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.CVE-2020-19046 · Other software · S-cms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.CVE-2020-22124 · Other software · Joyplus-cms Project · reported by MITREHigh 7.5
A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
- Product
- Joyplus-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloCVE-2020-20701 · Other software · S-cms · reported by MITREMedium 4.8
A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payCVE-2020-20700 · Other software · S-cms · reported by MITREMedium 4.8
A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the CoCVE-2020-20699 · Other software · S-cms · reported by MITREMedium 4.8
A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.CVE-2020-20698 · Other software · S-cms · reported by MITREHigh 7.2
A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.CVE-2019-17368 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2019joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.CVE-2019-17175 · Other software · Joyplus-cms Project · reported by MITREHigh 7.5
joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.
- Product
- Joyplus-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.CVE-2019-16660 · Other software · Joyplus Project · reported by MITREHigh 8.8
joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
- Product
- Joyplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.CVE-2019-16656 · Other software · Joyplus Project · reported by MITRECritical 9.8
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.
- Product
- Joyplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2019joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.CVE-2019-16655 · Other software · Joyplus Project · reported by MITREHigh 7.5
joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.
- Product
- Joyplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2019s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.CVE-2019-16312 · Other software · S-cms · reported by MITREMedium 6.1
s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Apr 2, 2019S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.CVE-2019-10708 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Mar 27, 2019S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9CVE-2019-10237 · Other software · S-cms · reported by MITREHigh 8.8
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Mar 22, 2019S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.CVE-2019-9925 · Other software · S-cms · reported by MITREMedium 6.1
S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Feb 23, 2019S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332.CVE-2019-9040 · Other software · S-cms · reported by MITREHigh 8.8
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Jan 25, 2019SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.CVE-2019-6805 · Other software · S-cms · reported by MITRECritical 9.8
SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2018An issue was discovered in S-CMS 1.0.CVE-2018-20480 · Other software · S-cms · reported by MITRECritical 9.8
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Dec 25, 2018An issue was discovered in S-CMS 1.0.CVE-2018-20479 · Other software · S-cms · reported by MITRECritical 9.8
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Dec 25, 2018An issue was discovered in S-CMS 1.0.CVE-2018-20478 · Other software · S-cms · reported by MITREHigh 7.5
An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Dec 25, 2018An issue was discovered in S-CMS 3.0.CVE-2018-20477 · Other software · S-cms · reported by MITRECritical 9.8
An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshell01.topshell01.top
Dec 25, 2018An issue was discovered in S-CMS 3.0.CVE-2018-20476 · Other software · S-cms · reported by MITREMedium 6.1
An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshell01.topshell01.top
Dec 10, 2018S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI.CVE-2018-20018 · Other software · S-cms · reported by MITREHigh 7.5
S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2018An issue was discovered in S-CMS v1.5.CVE-2018-19332 · Other software · S-cms · reported by MITREHigh 8.8
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkingflyme.blogspot.comkingflyme.blogspot.com
Nov 17, 2018An issue was discovered in S-CMS v1.5.CVE-2018-19331 · Other software · S-cms · reported by MITREHigh 7.5
An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkingflyme.blogspot.comkingflyme.blogspot.com
Nov 9, 2018An issue was discovered in S-CMS v1.5.CVE-2018-19145 · Other software · S-cms · reported by MITREMedium 6.1
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkingflyme.blogspot.comkingflyme.blogspot.com
Oct 31, 2018S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).CVE-2018-18887 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 17, 2018s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.CVE-2018-18427 · Other software · S-cms · reported by MITRECritical 9.8
s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.