Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
48 results
Sep 23, 2026SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies.CVE-2026-59167 · Other software · JiHong88 · reported by GitHubCritical 10
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.
- Product
- suneditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies.CVE-2026-54606 · Other software · JiHong88 · reported by GitHubHigh 8.5
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.
- Product
- suneditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-miCVE-2024-54855 · Other software · Fabricators · reported by MITREMedium 6.4
fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts.
- Product
- Vanilla OS Core Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64177 · Other software · MatiasDesuu · reported by GitHubMedium 5.4
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filtering. This is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64176 · Other software · MatiasDesuu · reported by GitHubMedium 5.3
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.CVE-2025-64327 · Other software · MatiasDesuu · reported by GitHubMedium 5.3
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.
- Product
- ThinkDashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2021@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component.CVE-2021-43785 · Other software · joeattardi · reported by GitHubHigh 7.6
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.
- Product
- emoji-button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.CVE-2010-4266 · Other software · Vanillaforums · reported by Red HatMedium 6.1
It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.vanillaforums.comopen.vanillaforums.com
Jun 22, 2021It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.CVE-2010-4264 · Other software · Vanillaforums · reported by Red HatMedium 6.1
It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Feb 10, 2020index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.CVE-2020-8825 · Other software · Vanillaforums · reported by MITREMedium 5.4
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 5, 2020Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.CVE-2011-1009 · Other software · Vanilla · reported by Red HatMedium 6.1
Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 22, 2020An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.CVE-2011-3614 · Other software · Vanilla · reported by Red HatCritical 9.8
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 22, 2020An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.CVE-2011-3613 · Other software · Vanilla · reported by Red HatHigh 7.5
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Mar 21, 2019In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class.CVE-2019-9889 · Other software · Vanillaforums · reported by MITRELow 2.7
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2019Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.CVE-2019-8279 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comMedium 5.4
Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscriptinjection.blogspot.comscriptinjection.blogspot.com
Nov 23, 2018Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_FoCVE-2018-19499 · Other software · Vanillaforums · reported by MITREHigh 7.2
Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Nov 3, 2018Vanilla 2.6.x before 2.6.4 allows remote code execution.CVE-2018-18903 · Other software · Vanillaforums · reported by MITRECritical 9.8
Vanilla 2.6.x before 2.6.4 allows remote code execution.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopen.vanillaforums.com
Sep 28, 2018Vanilla before 2.6.1 allows XSS via the email field of a profile.CVE-2018-17571 · Other software · Vanillaforums · reported by MITREMedium 6.1
Vanilla before 2.6.1 allows XSS via the email field of a profile.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 3, 2018Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodelCVE-2018-16410 · Other software · Vanillaforums · reported by MITREMedium 6.5
Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comopen.vanillaforums.com
Aug 26, 2018In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to seCVE-2018-15833 · Other software · Vanillaforums · reported by MITREMedium 4.3
In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comopen.vanillaforums.com
Jan 2, 2018Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin accessCVE-2017-1000432 · Other software · Vanillaforums · reported by MITREHigh 8
Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen.vanillaforums.comexploit-db.com
May 23, 2017The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentiallCVE-2016-10073 · Other software · Vanillaforums · reported by MITREHigh 7.5
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploitbox.io
Feb 25, 2015Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web scrCVE-2014-9685 · Other software · Vanillaforums · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvanillaforums.orgvanillaforums.org
May 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTMLCVE-2012-6557 · Other software · Zodiacdm · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) AboutMe/RealName, (2) AboutMe/Name, (3) AboutMe/Quote, (4) AboutMe/Loc, (5) AboutMe/Emp, (6) AboutMe/JobTit, (7) AboutMe/HS, (8) AboutMe/Col, (9) AboutMe/Bio, (10) AboutMe/Inter, (11) AboutMe/Mus, (12) AboutMe/Gam, (13) AboutMe/Mov, (14) AboutMe/FTV, or (15) AboutMe/Bks parameter to the Edit My Details page. NOTE: some of these details are obtained from third party information.
- Product
- Aboutme-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
May 23, 2013Multiple cross-site scripting (XSS) vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script CVE-2012-6556 · Other software · Jspautsch · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) User/FirstName or (2) User/LastName parameter to the edit user page. NOTE: some of these details are obtained from third party information.
- Product
- Firstlastnames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
May 23, 2013Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbitrary web script or HTML via tCVE-2012-6555 · Other software · Vanillaforums · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbitrary web script or HTML via the discussion title.
- Product
- Latestcomment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
May 10, 2013Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."CVE-2013-3528 · Other software · Vanillaforums · reported by MITREHigh 7.5
Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvanillaforums.orgexchange.xforce.ibmcloud.com
May 10, 2013Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the CVE-2013-3527 · Other software · Vanillaforums · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commfs-enterprise.com
Nov 15, 2012The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value durinCVE-2012-4954 · Other software · Vanillaforums · reported by cret@cert.orgLow 3.5
The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Sep 23, 2011Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error messCVE-2011-3812 · Other software · Vanillaforums · reported by MITREMedium 5
Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
Feb 8, 2011The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbCVE-2011-0910 · Other software · Vanillaforums · reported by MITREMedium 6.4
The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvanillaforums.orgvanillaforums.org
Feb 8, 2011Cross-site scripting (XSS) vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter toCVE-2011-0909 · Other software · Vanillaforums · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvanillaforums.orgvanillaforums.org
Feb 8, 2011Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via CVE-2011-0908 · Other software · Vanillaforums · reported by MITREMedium 5.8
Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvanillaforums.orgvanillaforums.org
Feb 8, 2011Cross-site scripting (XSS) vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the TarCVE-2011-0526 · Other software · Vanillaforums · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the Target parameter in a /entry/signin action.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 9, 2010Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers tCVE-2010-1337 · Other software · Lussumo · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers to execute arbitrary PHP code via a URL in the (1) include and (2) Configuration['LANGUAGE'] parameters.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 1, 2009Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTCVE-2009-1845 · Other software · Lussumo · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgsasec.blogspot.comlussumo.com
Aug 29, 2008Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary wCVE-2008-3874 · Other software · Lussumo · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs). NOTE: some of these details are obtained from third party information.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlussumo.comlussumo.com
Aug 21, 2008Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors.CVE-2008-3759 · Other software · Lussumo · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlussumo.comlussumo.com
Aug 21, 2008Cross-site request forgery (CSRF) vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrCVE-2008-3760 · Other software · Lussumo · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlussumo.comlussumo.com
Aug 21, 2008Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via tCVE-2008-3758 · Other software · Lussumo · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the (2) Account picture and (3) Icon fields in account.php. NOTE: some of these details are obtained from third party information.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlussumo.comlussumo.com
Oct 23, 2007Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID paraCVE-2007-5643 · Other software · Lussumo · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID parameter to ajax/sortcategories.php or (2) an unspecified vector to ajax/sortroles.php.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlussumo.comlussumo.com
Oct 23, 2007Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows remote attackers toCVE-2007-5644 · Other software · Lussumo · reported by MITREHigh 7.5
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities.
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Mar 3, 2007Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers CVE-2007-1251 · Other software · Netrek · reported by MITREHigh 9.3
Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.
- Product
- Netrek Vanilla Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecunia.com
Jul 25, 2006PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to executeCVE-2006-3850 · Other software · Lussumo · reported by MITREMedium 5.1
PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected
- Product
- Vanilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecuritytracker.com
Jun 12, 2006Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML CVE-2006-2990 · Other software · Vanillasoft · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
- Product
- Vanillasoft Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpridels0.blogspot.comsecunia.com
Feb 3, 2006Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknCVE-2006-0541 · Other software · Tachyon · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages."
- Product
- Vanilla Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevuln.comsecurityfocus.com
Feb 3, 2006Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2006-0540 · Other software · Tachyon · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Vanilla Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevuln.comsecurityfocus.com
Oct 5, 2005Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libCVE-2005-3149 · Other software · UIM · reported by MITREMedium 4.6
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
- Product
- UIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.freedesktop.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.