Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Feb 3, 2026Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries.CVE-2020-37076 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.8
Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based, error-based, and time-based injection techniques.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2026Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image CVE-2020-37073 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.6
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file with a 'cmd' parameter.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2026Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts.CVE-2020-37072 · Other software · VictorAlagwu · reported by VulnCheckMedium 5.1
Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. Attackers can submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in victim browsers.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 27, 2026Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature.CVE-2020-36942 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.7
Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 8, 2023SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.CVE-2020-23966 · Other software · Victor CMS Project · reported by MITRECritical 9.8
SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_CVE-2020-35597 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Apr 28, 2022SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.CVE-2022-28060 · Other software · Victor CMS Project · reported by MITREHigh 7.5
SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.CVE-2022-27478 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.CVE-2022-26201 · Other software · Victor CMS Project · reported by MITRECritical 9.8
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.CVE-2022-23873 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user.CVE-2021-46459 · Other software · Victor CMS Project · reported by MITREHigh 7.5
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post.CVE-2021-46458 · Other software · Victor CMS Project · reported by MITREHigh 7.5
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2021Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_aCVE-2021-25203 · Other software · Victor CMS Project · reported by MITRECritical 9.8
Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2020The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.CVE-2020-29280 · Other software · Victor CMS Project · reported by MITRECritical 9.8
The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2020A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file.CVE-2020-23945 · Other software · Victor CMS Project · reported by MITREHigh 7.5
A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.CVE-2020-15599 · Other software · Victor CMS Project · reported by MITREMedium 6.1
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 22, 2020Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.CVE-2020-13427 · Other software · Victorcms Project · reported by MITREMedium 6.1
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
- Product
- Victorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 10, 2018An issue was discovered in Victor CMS through 2018-05-10.CVE-2018-16775 · Other software · Victor CMS Project · reported by MITREMedium 4.8
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2018An issue was discovered in Victor CMS through 2018-05-10.CVE-2018-15603 · Other software · Victor CMS Project · reported by MITREMedium 6.1
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.