Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
67 results · page 1 of 2
Oct 28, 2026FearlessCMS is a flat-file `content` management system centered on simplicity and open source.CVE-2026-63190 · Other software · fearlessgeekmedia · reported by GitHubCritical 9.4
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint acc
- Product
- FearlessCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sitesCVE-2026-111658 · Other software · SiteServer · reported by VulnCheckMedium 5.1
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
- Product
- SSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026FearlessCMS is a flat-file content management system centered on simplicity and open source.CVE-2026-55695 · Other software · fearlessgeekmedia · reported by GitHubCritical 9.1
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
- Product
- FearlessCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary CVE-2026-52307 · Other software · reported by MITREMedium 5.4
An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclasscms.comgithub.com
Aug 30, 2026A vulnerability was found in SiteServer SSCMS 7.4.0.CVE-2026-82486 · Other software · SiteServer · reported by VulDBLow 2.3
A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- SSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary CVE-2026-73679 · Other software · ImpressCMS · reported by VulnCheckHigh 8.6
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.
- Product
- ImpressCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2026ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitraCVE-2021-47938 · Other software · Impresscms · reported by VulnCheckHigh 8.7
ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Attackers can authenticate, submit a POST request to /modules/system/admin.php?fct=autotasks&op=mod with crafted sat_code containing PHP commands, which creates an executable file that accepts arbitrary commands via GET parameters.
- Product
- ImpressCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comimpresscms.org
Apr 30, 2026SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without pCVE-2026-7435 · Other software · siteserver · reported by VulnCheckHigh 8.6
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.
- Product
- SSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by craCVE-2026-7429 · Other software · siteserver · reported by VulnCheckLow 2.1
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.
- Product
- SSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL coCVE-2019-25703 · Other software · Impresscms · reported by VulnCheckHigh 7.1
ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.
- Product
- ImpressCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimpresscms.orgsourceforge.net
Mar 22, 2026A vulnerability has been found in SSCMS 4.7.0.CVE-2026-4542 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A security flaw has been discovered in SSCMS 7.4.0.CVE-2026-4234 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in SSCMS up to 7.4.0.CVE-2026-4222 · Other software · reported by VulDBLow 2
A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files.CVE-2022-50912 · Other software · ImpressCMS · reported by VulnCheckCritical 9.3
ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.
- Product
- ImpressCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 10, 2025Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.phpCVE-2025-56431 · Other software · Fearlessgeekmedia · reported by MITREHigh 7.5
Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the file_get_contents() function.
- Product
- Fearlesscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.phpCVE-2025-56430 · Other software · Fearlessgeekmedia · reported by MITREHigh 7.5
Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function.
- Product
- Fearlesscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information via the login.php compCVE-2025-56429 · Other software · Fearlessgeekmedia · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information via the login.php component.
- Product
- Fearlesscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.CVE-2025-52237 · Other software · Sscms · reported by MITREMedium 6.5
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET reqCVE-2025-45529 · Other software · Sscms · reported by MITREHigh 7.1
An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 18, 2025imFAQ is an advanced questions and answers management system for ImpressCMS.CVE-2025-29930 · Other software · ImpressModules · reported by GitHubMedium 6.9
imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET['seoOp'] and $_GET['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1.
- Product
- imfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025ClassCMS v4.8 has a code execution vulnerability.CVE-2024-57099 · Other software · Classcms · reported by MITRECritical 9.8
ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model management feature, allowing them to execute arbitrary code and potentially take control of the server.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.CVE-2024-57097 · Other software · Classcms · reported by MITREMedium 4.8
ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A vulnerability has been found in ClassCMS up to 4.8 and classified as critical.CVE-2024-12666 · Other software · Classcms · reported by VulDBMedium 5.1
A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024A vulnerability classified as problematic was found in ClassCMS 4.8.CVE-2024-12503 · Other software · Classcms · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to CVE-2024-48180 · Other software · classcms · reported by MITRECritical 9.8
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2024A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8.CVE-2024-8145 · Other software · classcms · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the argument Title leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2024A vulnerability classified as problematic was found in ClassCMS 4.8.CVE-2024-8144 · Other software · classcms · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024A vulnerability was found in ClassCMS 4.5.CVE-2024-6932 · Other software · classcms · reported by VulDBMedium 5.3
A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?action=home&do=shop:index&keyword=&kind=all. The manipulation of the argument order leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271987.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."CVE-2024-31613 · Other software · bosscms · reported by MITREMedium 5.4
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
- Product
- bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuratioCVE-2024-31609 · Other software · code-projects · reported by MITREHigh 7.1
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
- Product
- simple_school_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.cCVE-2024-22938 · Other software · Bosscms · reported by MITREHigh 7.8
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.CVE-2023-43953 · Other software · Sscms · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.CVE-2023-43952 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.CVE-2023-43951 · Other software · Sscms Project · reported by MITREMedium 5.4
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
- Product
- Sscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2023-37785 · Other software · Impresscms · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023SiteServerCMS 7.1.3 sscms has a file read vulnerability.CVE-2022-44299 · Other software · Sscms · reported by MITREMedium 4.9
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023SiteServer CMS 7.1.3 is vulnerable to SQL Injection.CVE-2022-44298 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.CVE-2022-44297 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.CVE-2022-45966 · Other software · Classcms Project · reported by MITRECritical 9.8
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
- Product
- Classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-44937 · Other software · Bosscms · reported by MITREMedium 6.5
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).CVE-2022-30349 · Other software · Sscms · reported by MITREMedium 6.1
siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-42656 · Other software · Sscms · reported by MITREMedium 5.4
SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.CVE-2021-42655 · Other software · Sscms · reported by MITREHigh 8.8
SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code.CVE-2021-42654 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd.CVE-2022-28606 · Other software · Bosscms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbosscms.netcnvd.org.cn
May 2, 2022SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.CVE-2022-28118 · Other software · Sscms · reported by MITRECritical 9.8
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
- Product
- Siteserver CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the CVE-2022-26986 · Other software · Impresscms · reported by MITREHigh 7.2
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 27, 2022ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.CVE-2021-26601 · Other software · Impresscms · reported by MITREHigh 8.1
ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.compacketstormsecurity.com
Mar 27, 2022ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).CVE-2021-26600 · Other software · Impresscms · reported by MITRECritical 9.8
ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.compacketstormsecurity.com
Mar 27, 2022ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.CVE-2021-26599 · Other software · Impresscms · reported by MITRECritical 9.8
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
- Product
- Impresscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.