Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
138 results · page 1 of 3
Oct 22, 2026DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and inclCVE-2021-48016 · Other software · DedeCMS · reported by VulnCheckCritical 9.3
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- DedeCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameCVE-2021-48015 · Other software · erzhongxmu · reported by VulnCheckHigh 8.7
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
- Product
- JeeWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitraryCVE-2026-89310 · Other software · JTL SW GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.4
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
- Product
- JTL-WMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases.CVE-2026-89309 · Other software · JTL SW GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 10
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
- Product
- JTL-WMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108782 · Other software · erzhongxmu · reported by VulDBLow 2.1
A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108781 · Other software · erzhongxmu · reported by VulDBLow 2.1
A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108779 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108778 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108777 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108775 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108774 · Other software · erzhongxmu · reported by VulDBLow 2.1
A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39.CVE-2026-108773 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was detected in erzhongxmu Jeewms up to 3.7.CVE-2026-108684 · Other software · erzhongxmu · reported by VulDBMedium 5.3
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability.CVE-2026-66272 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability.CVE-2026-66271 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability.CVE-2026-66270 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability.CVE-2026-63702 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability.CVE-2026-63701 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability.CVE-2026-63700 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabiliCVE-2026-49506 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability.CVE-2026-41120 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability.CVE-2026-44274 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability.CVE-2026-44273 · Other software · Dell · reported by security_alert@emc.comMedium 6
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vuCVE-2026-44272 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vuCVE-2026-44271 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Wyse Management Suite (WMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69.CVE-2026-11458 · Other software · erzhongxmu · reported by VulDBMedium 5.5
A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JeeWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69.CVE-2026-11457 · Other software · erzhongxmu · reported by VulDBMedium 5.5
A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JeeWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code viCVE-2026-37430 · Other software · reported by MITREHigh 7.3
An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 13, 2026qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.CVE-2026-37429 · Other software · reported by MITREMedium 6.5
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII) via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 13, 2026qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.CVE-2026-37428 · Other software · reported by MITREMedium 6.5
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 11, 2026A vulnerability was detected in FeMiner wms up to 1.0.CVE-2026-3969 · Other software · FeMiner · reported by VulDBMedium 5.5
A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the component Basic Organizational Structure Module. Performing a manipulation of the argument Name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- wms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability.CVE-2026-23859 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabiCVE-2026-23858 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script Injection.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability.CVE-2026-22766 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability.CVE-2026-22765 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in erzhongxmu JEEWMS up to 3.7.CVE-2026-3028 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was found in erzhongxmu JEEWMS up to 3.7.CVE-2026-3027 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability has been found in erzhongxmu JEEWMS 3.7.CVE-2026-3026 · Other software · erzhongxmu · reported by VulDBMedium 5.5
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026JEEWMS 1.0 is vulnerable to SQL Injection.CVE-2025-70311 · Other software · Huayi-tec · reported by MITREMedium 6.5
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface for attack.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2026A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa.CVE-2026-1059 · Other software · FeMiner · reported by VulDBMedium 5.5
A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown functionality of the file /src/chkuser.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- wms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadContCVE-2025-60268 · Other software · Huayi-tec · reported by MITREMedium 6.5
An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code execution.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportECVE-2025-60269 · Other software · Huayi-tec · reported by MITRECritical 9.4
JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do componentCVE-2025-55834 · Other software · Huayi-tec · reported by MITREMedium 6.1
A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.CVE-2024-53499 · Other software · Jeewms · reported by MITRECritical 9.8
Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuayi-tec.comgitee.com
Aug 20, 2025JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.CVE-2025-50901 · Other software · Jeewms · reported by MITRECritical 9.8
JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3.CVE-2025-8163 · Other software · deerwms · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- deer-wms-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3.CVE-2025-8162 · Other software · deerwms · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the file /system/dept/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- deer-wms-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3.CVE-2025-8161 · Other software · deerwms · reported by VulDBLow 2.1
A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /system/role/export. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- deer-wms-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3.CVE-2025-8127 · Other software · deerwms · reported by VulDBLow 2.1
A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. This vulnerability affects unknown code of the file /system/user/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- deer-wms-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3.CVE-2025-8126 · Other software · deerwms · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/user/export. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- deer-wms-2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.