Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
93 results · page 1 of 2
Aug 18, 2026SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.CVE-2026-75626 · Other software · smicallef · reported by VulnCheckCritical 9.3
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
- Product
- spiderfoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.CVE-2026-65553 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2026MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting maliciousCVE-2018-25422 · Other software · spider312 · reported by VulnCheckHigh 8.8
MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the id parameter. Attackers can send GET requests to play.php with crafted SQL payloads in the id parameter to extract sensitive database information including usernames and other data.
- Product
- MOGG web simulator Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 27, 2026Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read pCVE-2026-48923 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
- Product
- Jenkins AppSpider Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026In the Linux kernel, the following vulnerability has been resolved: spi: spidev: fix lock inversion between spi_lock and buf_lock The spidev driver previouslyCVE-2026-43319 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: spi: spidev: fix lock inversion between spi_lock and buf_lock The spidev driver previously used two mutexes, spi_lock and buf_lock, but acquired them in different orders depending on the code path: write()/read(): buf_lock -> spi_lock ioctl(): spi_lock -> buf_lock This AB-BA locking pattern triggers lockdep warnings and can cause real deadlocks: WARNING: possible circular locking dependency detected spidev_ioctl() -> mutex_lock(&spidev->buf_lock) spidev_sync_write() -> mutex_lock(&spidev->spi_lock) *** DEADLOCK *** The issue is reproducible with a simple userspace program that performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from separate threads on the same spidev file descriptor. Fix this by simplifying the locking model and removing the lock inversion entirely. spidev_sync() no longer performs any locking, and all callers serialize access using spi_lock. buf_lock is removed since its functionality is fully covered by spi_lock, eliminating the possibility of lock ordering issues. This removes the lock inversion and prevents deadlocks without changing userspace ABI or behaviour
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 22, 2026IMGspider: Server-Side Request Forgery (SSRF)CVE-2026-22482 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.
- Product
- IMGspider
- Affected
- up to 2.3.12
- What to do
- Affects up to 2.3.12. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2025Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002.CVE-2021-4467 · Other software · Positive Technologies · reported by VulnCheckHigh 8.7
Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The service generates a new session identifier for each incoming connection without adequately limiting concurrent requests. An unauthenticated remote attacker can repeatedly issue HTTPS requests to the service, causing excessive allocation of session identifiers. Under load, session identifier collisions may occur, forcing active client sessions to disconnect and resulting in service disruption.
- Product
- MaxPatrol 8 (Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvulners.com
Sep 30, 2025Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in theCVE-2025-11195 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.
- Product
- AppSpider Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier.CVE-2025-48006 · Other software · Saison Technology Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service (DoS) condition may occur.
- Product
- DataSpider Servista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, wherebCVE-2025-36857 · Other software · Rapid7 · reported by cve@rapid7.comLow 3.3
Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management. This vulnerability was remediated in version 7.5.021 of the product.
- Product
- Appspider Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2025-9376 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 11.58
- What to do
- Affects up to 11.58. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 20, 2025Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field.CVE-2025-4951 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.6
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018
- Product
- AppSpider Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025SpiderDisplay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through <= 1.9.1.
- Product
- SpiderDisplay
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update SpiderDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Spider Elements: Missing AuthorizationCVE-2025-32216 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Spider Themes Spider Elements spider-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spider Elements: from n/a through <= 1.6.6.
- Product
- Spider Elements
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Spider Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Spider Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32182 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spider Themes Spider Elements spider-elements allows Stored XSS.This issue affects Spider Elements: from n/a through <= 1.6.5.
- Product
- Spider Elements
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Spider Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID.CVE-2025-24894 · Other software · italia · reported by GitHubCritical 9.1
SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The validation logic of the signature is central as it ensures that you cannot create a SAML response with arbitrary assertions and then impersonate other users. There is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulnerable SDK
- Product
- spid-aspnetcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Spiderpowa Embed PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jim2212001 Spiderpowa Embed PDF spiderpowa-embed-pdf allows Stored XSS.This issue affects Spiderpowa Embed PDF: from n/a through <= 1.0.
- Product
- Spiderpowa Embed PDF
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Spiderpowa Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2025WP SPID Italia: Stored Cross-Site ScriptingCVE-2024-11758 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP SPID Italia
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update WP SPID Italia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 4, 2024binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.CVE-2024-39163 · Other software · reported by MITREHigh 8.8
binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Nov 29, 2024pyspider through 0.3.10 allows /update XSS.CVE-2024-39162 · Other software · reported by MITREMedium 6.1
pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pyspider.orggithub.com
Oct 24, 2024iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability.CVE-2024-10313 · Other software · iniNet Solutions · reported by ics-cert@hq.dhs.govHigh 8.6
iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control.
- Product
- SpiderControl SCADA PC HMI Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.CVE-2024-8232 · Other software · iniNet Solutions GmbH · reported by ics-cert@hq.dhs.govHigh 8.7
SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.
- Product
- SpiderControl SCADA Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024SpiderContacts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- SpiderContacts
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update SpiderContacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 15, 2024A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows.CVE-2024-6746 · Other software · NaiboWang · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue "because the default is that the software runs locally without going through the Internet".
- Product
- EasySpider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6319 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- IMGspider
- Affected
- up to 2.3.10
- What to do
- Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6318 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- IMGspider
- Affected
- up to 2.3.10
- What to do
- Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 30, 2024Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2024-4355 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the stopbadbots_get_ajax_data() function in all versions up to, and including, 10.23. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose visitor data.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 10.23
- What to do
- Affects up to 10.23. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2024Admin Page Spider: Stored Cross-Site ScriptingCVE-2024-2401 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Admin Page Spider
- Affected
- up to 3.31
- What to do
- Affects up to 3.31. Update Admin Page Spider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 1, 2024An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.CVE-2024-33393 · Other software · spidernet-io · reported by MITREMedium 6.2
An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Product
- spiderpool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 31, 2024SpiderFAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderFAQ allows Reflected XSS.This issue affects SpiderFAQ: from n/a through 1.3.2.
- Product
- SpiderFAQ
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update SpiderFAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 6, 2024Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtCVE-2024-28155 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
- Product
- Jenkins AppSpider Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 27, 2024A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML CVE-2024-1892 · Other software · scrapy · reported by security@huntr.devMedium 6.5
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
- Product
- scrapy/scrapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A vulnerability, which was classified as critical, was found in spider-flow 0.4.3.CVE-2024-0195 · Other software · Ssssssss · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.
- Product
- Spider-flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023SpiderVPlayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48320 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderVPlayer allows Stored XSS.This issue affects SpiderVPlayer: from n/a through 1.5.22.
- Product
- SpiderVPlayer
- Affected
- up to 1.5.22
- What to do
- Affects up to 1.5.22. Update SpiderVPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 16, 2023A vulnerability was found in spider-flow up to 0.5.0.CVE-2023-5016 · Other software · Ssssssss · reported by VulDBMedium 6.3
A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.java of the component API. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239857 was assigned to this vulnerability.
- Product
- Spider-flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal.CVE-2023-3329 · Other software · iniNet · reported by ics-cert@hq.dhs.govMedium 6.5
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
- Product
- SCADAWebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key.CVE-2023-28937 · Other software · SAISON INFORMATION SYSTEMS CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.8
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS, which is common to all users. If an attacker who can gain access to a target DataSpider Servista instance and obtain a Launch Settings file of ScriptRunner and/or ScriptRunner for Amazon SQS, the attacker may perform operations with the user privilege encrypted in the file. Note that DataSpider Servista and some of the OEM products are affected by this vulnerability. For the details of affected products and versions, refer to the information listed in [References].
- Product
- DataSpider Servista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcs.wingarc.comcs.wingarc.com
May 16, 2023A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL CVE-2023-32999 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
- Product
- Jenkins AppSpider Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and seCVE-2023-32998 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
- Product
- Jenkins AppSpider Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the CVE-2023-25184 · Other software · Seiko Solutions Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier.
- Product
- SkyBridge MB-A200, SkyBridge BASIC MB-A130, and SkySpider MB-R210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 7.24
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Jul 10, 2022The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsCVE-2022-31504 · Other software · Baiduwenkuspider Flaskweb Project · reported by MITRECritical 9.3
The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Baiduwenkuspider Flaskweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
- Product
- SpiderCalendar
- Affected
- up to 1.5.65
- What to do
- Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots: Does not sanitise and escape the User Agent before using it in a SQL statement to save itCVE-2021-24863 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
- Product
- WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots
- Fixed in
- 6.67
- What to do
- Update WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots to 6.67 or newer.
Nov 8, 2021SpiderCatalog: Does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statementCVE-2021-24625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
- Product
- SpiderCatalog
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update SpiderCatalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 10, 2021spideranalyse: Reflected Cross-Site ScriptingCVE-2021-38350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.
- Product
- spideranalyse
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update spideranalyse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 4, 2020Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by uCVE-2020-2314 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.5
Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins AppSpider Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker wiCVE-2020-7358 · Other software · Rapid7 · reported by cve@rapid7.comMedium 5.8
In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.
- Product
- AppSpider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.rapid7.comhelp.rapid7.com
Feb 7, 2020A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitCVE-2014-5087 · Other software · Sphider · reported by MITRECritical 9.8
A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code.
- Product
- Sphider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvulmon.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.