Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Aug 28, 2026SOY CMS contains an issue with deserialization of untrusted data.CVE-2026-78032 · Other software · Tsuyoshi Saito · reported by vultures@jpcert.or.jpCritical 9.3
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
- Product
- SOY CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops.CVE-2024-28187 · Other software · inunosinsi · reported by GitHubHigh 7.2
SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload.CVE-2020-15189 · Other software · inunosinsi · reported by GitHubMedium 6.8
SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE).CVE-2020-15188 · Other software · inunosinsi · reported by GitHubCritical 10
SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2020The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE).CVE-2020-15182 · Other software · inunosinsi · reported by GitHubHigh 8.4
The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2019SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box.CVE-2019-11376 · Other software · Brassica · reported by MITREHigh 7.2
SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own.
- Product
- SOY CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cngithub.com
May 12, 2017Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vCVE-2017-2164 · Other software · Nippon Institute of Agroinformatics Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- SOY CMS with installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2017Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id.CVE-2017-2163 · Other software · Nippon Institute of Agroinformatics Ltd. · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id.
- Product
- SOY CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2014Cross-site scripting (XSS) vulnerability in Nippon Institute of Agroinformatics SOY CMS 1.4.0c and earlier allows remote attackers to inject arbitrary web scripCVE-2014-1998 · Other software · N-i-agroinformatics · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Nippon Institute of Agroinformatics SOY CMS 1.4.0c and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- SOY CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.