Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Jun 4, 2025An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.CVE-2025-46204 · Other software · Changeweb · reported by MITREMedium 6.5
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.CVE-2025-46203 · Other software · Changeweb · reported by MITREMedium 6.5
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users.CVE-2024-2292 · Other software · changeweb · reported by security@huntr.devHigh 7.1
Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users.
- Product
- changeweb/unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers.CVE-2025-25621 · Other software · Changeweb · reported by MITREMedium 4.3
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.CVE-2025-25618 · Other software · Changeweb · reported by MITRELow 3.3
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.CVE-2025-25620 · Other software · Changeweb · reported by MITREMedium 5.4
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.CVE-2025-25614 · Other software · Changeweb · reported by MITREHigh 8.8
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams.CVE-2025-25616 · Other software · Changeweb · reported by MITREMedium 4.3
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.CVE-2025-25615 · Other software · Changeweb · reported by MITRELow 2.7
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.CVE-2025-25617 · Other software · reported by MITREMedium 4.3
Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025Unifiedtransform v2.X is vulnerable to Incorrect Access Control.CVE-2024-53573 · Other software · Changeweb · reported by MITRECritical 9.8
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/{id}.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgetastra.com
Dec 9, 2024A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data wCVE-2024-12307 · Other software · Unifiedtransform · reported by vulnerability@ncsc.chMedium 4.3
A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the student editing functionality. At the time of publication of the CVE no patch is available.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of stCVE-2024-12306 · Other software · Unifiedtransform · reported by vulnerability@ncsc.chMedium 4.3
Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades.CVE-2024-12305 · Other software · Unifiedtransform · reported by vulnerability@ncsc.chMedium 4.3
An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module.CVE-2024-27665 · Other software · reported by MITREMedium 5.4
Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.