Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42 results
Oct 30, 2026CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter aCVE-2026-119656 · Other software · CoreUnion · reported by VulnCheckHigh 8.7
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
- Product
- CoreShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appCVE-2026-119655 · Other software · CoreUnion · reported by VulnCheckHigh 8.7
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
- Product
- CoreShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026the getFollowsPage() function that: WpDiscuz before 7.6.47 contains a cross-site request forgeryCVE-2026-22215 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
- Product
- the getFollowsPage() function that
- Fixed in
- 7.6.47
- What to do
- Update the getFollowsPage() function that to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
May 11, 2025A vulnerability, which was classified as critical, was found in LyLme Spage 2.1.CVE-2025-4543 · Other software · LyLme · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_link.php. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zCVE-2022-49554 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 5, 2024Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control.CVE-2024-48176 · Other software · lylme · reported by MITRECritical 9.8
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.CVE-2024-48356 · Other software · lylme · reported by MITRECritical 9.8
LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.CVE-2024-48357 · Other software · lylme · reported by MITRECritical 9.8
LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in LyLme_spage 1.9.5.CVE-2024-9790 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability was found in LyLme_spage 1.9.5. It has been classified as critical. Affected is an unknown function of the file /admin/sou.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9789 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability was found in LyLme_spage 1.9.5 and classified as critical. This issue affects some unknown processing of the file /admin/apply.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9788 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. This vulnerability affects unknown code of the file /admin/tag.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.CVE-2024-36675 · Other software · lylme · reported by MITRECritical 9.1
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.CVE-2024-36674 · Other software · lylme · reported by MITREMedium 6.1
LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a craftCVE-2024-34982 · Other software · lylme · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.CVE-2024-33144 · Other software · j2eefast · reported by MITREHigh 8.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted fCVE-2023-45952 · Other software · Lylme · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- Lylme Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.CVE-2023-45951 · Other software · Lylme · reported by MITRECritical 9.8
lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.
- Product
- Lylme Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023PressPage Entertainment Inc: Cross-Site Request Forgery (CSRF)CVE-2023-37992 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
- Product
- PressPage Entertainment Inc
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update PressPage Entertainment Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 29, 2023PressPage Entertainment Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-41661 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
- Product
- PressPage Entertainment Inc
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update PressPage Entertainment Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 28, 2023In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bypass.CVE-2023-21174 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235822222
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 6, 2023PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.CVE-2023-29632 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.
- Product
- Jmspagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Feb 15, 2022A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requiremeCVE-2021-46252 · Other software · Scratch-wiki · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.
- Product
- Scratch Confirmaccount V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterVCVE-2021-43941 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Nov 30, 2021# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn resCVE-2021-3727 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.CVE-2021-33807 · Other software · Gespage · reported by MITREHigh 7.5
Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.
- Product
- Gespage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.gespage.comcartadis.com
Jan 22, 2020ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)CVE-2011-4943 · Other software · ImpressPages CMS · reported by Red HatCritical 9.8
ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)
- Product
- ImpressPages CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 7, 2018content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.CVE-2018-12043 · Other software · Getsymphony · reported by MITREMedium 6.1
content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
- Product
- Symphony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2018Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTML via the email, pasCVE-2018-9147 · Other software · Gespage · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTML via the email, passwd, and repasswd parameters to webapp/users/user_reg.jsp.
- Product
- Gespage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgurelahmet.comgurelahmet.com
Jan 8, 2018Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer naCVE-2017-7998 · Other software · Gespage · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer name when adding a printer in the admin panel or (2) username parameter to webapp/users/user_reg.jsp.
- Product
- Gespage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsysdream.com
Jan 8, 2018Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webappCVE-2017-7997 · Other software · Gespage · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.
- Product
- Gespage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsysdream.com
Oct 23, 2017Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter,CVE-2017-15805 · Network & remote access · Cisco · reported by MITREHigh 7.5
Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files.
- Product
- Small Business Sa520 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfwhibbit.esfwhibbit.es
Sep 19, 2017Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPreCVE-2015-4089 · WordPress plugins & themes · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
- Fixed in
- 0.8.3.5
- What to do
- Update the plugin to 0.8.3.5 or newer.
Full record and what to do →NVD recordopenwall.comwordpress.org
Oct 21, 2015Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and cCVE-2015-7823 · Other software · Kentico · reported by MITREMedium 5.8
Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.
- Product
- Kentico CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 5, 2014Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authenCVE-2014-2916 · Websites & servers · Phplist · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.davidsopas.comsecunia.com
Oct 6, 2012Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allowCVE-2011-4932 · Other software · Impresspages · reported by Red HatHigh 7.5
Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allows remote attackers to execute arbitrary code via the cm_group parameter.
- Product
- Impresspages CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comseclists.org
Aug 12, 2009WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remotCVE-2009-2200 · Computers, phones & browsers · Apple · reported by MITREHigh 7.1
WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.opensuse.org
Jul 9, 2009SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary CVE-2009-2394 · Other software · Smspages · reported by MITREHigh 7.5
SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
- Product
- Smspages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 31, 2008BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls theCVE-2008-1557 · Other software · Bolinos · reported by MITREMedium 5
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls the phpinfo function.
- Product
- Bolinos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jun 2, 2006The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installCVE-2006-2784 · Computers, phones & browsers · Mozilla · reported by MITREMedium 5.1
The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs. NOTE: the manual install button is used for downloading software from a remote web site, so this issue would not cross privilege boundaries if the user progresses to the point of installing malicious software from the attacker-controlled site.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comsecunia.com
Apr 18, 2005The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of CVE-2005-0752 · Computers, phones & browsers · Mozilla · reported by Red HatHigh 7.5
The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commozilla.org
Sep 24, 2002Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.CVE-2002-0376 · Computers, phones & browsers · Apple · reported by MITREHigh 7.5
Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.
- Product
- Quicktime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comatstake.com
Sep 2, 1999Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.CVE-1999-0685 · Other software · Netscape · reported by MITREMedium 5.1
Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.
- Product
- Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.