Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 16, 2026ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwritCVE-2026-111655 · Other software · zoujingli · reported by VulnCheckMedium 5.1
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
- Product
- think-plugs-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2024A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67.CVE-2024-10749 · Other software · Thinkadmin · reported by VulDBLow 2.3
A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67. Affected is the function script of the file /app/admin/controller/api/Plugs.php. The manipulation of the argument uptoken leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted ZiCVE-2023-48966 · Other software · Thinkadmin · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP filCVE-2023-48965 · Other software · Thinkadmin · reported by MITREHigh 8.8
An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.CVE-2023-34833 · Other software · Thinkadmin · reported by MITREMedium 6.1
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Mar 3, 2021ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.CVE-2020-35296 · Other software · Thinkadmin · reported by MITREHigh 7.5
ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/apiCVE-2020-23653 · Other software · Thinkadmin · reported by MITRECritical 9.8
An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.CVE-2020-29315 · Other software · Thinkadmin · reported by MITREMedium 5.4
ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020ThinkAdmin v6 is affected by a directory traversal vulnerability.CVE-2020-25540 · Other software · Thinkadmin · reported by MITREHigh 7.5
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 8, 2019application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.CVE-2019-11018 · Other software · Thinkadmin · reported by MITRECritical 9.8
application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.
- Product
- Thinkadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.