Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Oct 28, 2026Topluyo is a social networking platform.CVE-2026-115904 · Other software · topluyo · reported by GitHubCritical 9.6
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Open Source Social Network (OSSN) is open-source social networking software developed in PHP.CVE-2026-41309 · Other software · opensource-socialnetwork · reported by GitHubHigh 8.2
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \times 4000$ pixels) before processing begins.
- Product
- opensource-socialnetwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation CVE-2023-6420 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esMedium 6.5
A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation oCVE-2023-6419 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esMedium 6.5
A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter.CVE-2023-6418 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter.CVE-2023-6417 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parCVE-2023-6416 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameteCVE-2023-6415 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user pCVE-2023-6414 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user pCVE-2023-6413 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameterCVE-2023-6412 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in the update parameteCVE-2023-6411 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in the update parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parCVE-2023-6410 · Other software · Voovi Social Networking Script · reported by cve-coordination@incibe.esCritical 9.8
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
- Product
- Voovi Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname.CVE-2022-30460 · Other software · Simple Social Networking Site Project · reported by MITREMedium 5.4
Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname.
- Product
- Simple Social Networking Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2014The Social Networking (aka com.wSocialNetworkingSites) application 0.33.13320.99980 for Android does not verify X.509 certificates from SSL servers, which allowCVE-2014-5937 · Other software · Freediyhomeimprovement · reported by cret@cert.orgMedium 5.4
The Social Networking (aka com.wSocialNetworkingSites) application 0.33.13320.99980 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Social Networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 1, 2010Multiple cross-site scripting (XSS) vulnerabilities in forum_new_topic.php in Chameleon Social Networking allow remote attackers to inject arbitrary web script CVE-2010-4366 · Other software · Abk-soft · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forum_new_topic.php in Chameleon Social Networking allow remote attackers to inject arbitrary web script or HTML via the (1) thread_title and (2) thread_description parameters in a message.
- Product
- Chameleon Social Networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Nov 20, 2007PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrarCVE-2007-6057 · Other software · Datecomm · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
- Product
- Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2007SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary SQL commanCVE-2007-5992 · Other software · Datecomm · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewcat s action on the forums page.
- Product
- Social Networking Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Sep 13, 2007SQL injection vulnerability in profile/myprofile.php in psi-labs.com social networking script (psisns), probably 1.0, allows remote attackers to execute arbitraCVE-2007-4881 · Other software · Psi-labs · reported by MITREHigh 7.5
SQL injection vulnerability in profile/myprofile.php in psi-labs.com social networking script (psisns), probably 1.0, allows remote attackers to execute arbitrary SQL commands via the u parameter.
- Product
- Social Networking Script Psisns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.