Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
63 results · page 1 of 2
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore(CVE-2026-111231 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to exeCVE-2026-111226 · Other software · Netgate · reported by VulnCheckHigh 8.6
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting aCVE-2026-111221 · Other software · Netgate · reported by VulnCheckHigh 7.5
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Sep 28, 2026A vulnerability was found in RaspAP raspap-webgui up to 3.5.5.CVE-2026-101860 · Other software · RaspAP · reported by VulDBHigh 7.4
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 28, 2026A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5.CVE-2026-101859 · Other software · RaspAP · reported by VulDBLow 2.1
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_ovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfg_id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 28, 2026A flaw has been found in RaspAP raspap-webgui up to 3.5.5.CVE-2026-101858 · Other software · RaspAP · reported by VulDBLow 2
A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 10, 2026Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name,CVE-2022-26962 · Other software · reported by MITREMedium 5.4
Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V.CVE-2026-16876 · Other software · NEC Corporation · reported by psirt-info@cyber.jp.nec.comCritical 9.3
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.
- Product
- UNIVERGE IX-R/IX-V
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsCVE-2022-26961 · Other software · reported by MITREMedium 5.4
Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.CVE-2024-39024 · Other software · reported by MITREHigh 8.8
In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability.CVE-2026-24788 · Other software · RaspAP · reported by vultures@jpcert.or.jpHigh 8.7
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.CVE-2025-50428 · Other software · Raspap · reported by MITRECritical 9.8
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.
- Product
- Raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.smarttecs.comgithub.com
Aug 26, 2025The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user.CVE-2025-41702 · Other software · Welotec · reported by info@cert.vde.comCritical 9.8
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
- Product
- EG400Mk2-D11001-000101
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI.CVE-2025-53472 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.6
WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.
- Product
- WRC-BE36QS-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other managemenCVE-2025-27026 · Other software · Infinera · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.9
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
- Product
- G42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeuvd.enisa.europa.eucvcn.gov.it
Jul 2, 2025Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI cCVE-2025-27023 · Other software · Infinera · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.5
Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.
- Product
- G42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeuvd.enisa.europa.eucvcn.gov.it
Jul 2, 2025A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP CVE-2025-27022 · Other software · Infinera · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.5
A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.
- Product
- G42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeuvd.enisa.europa.eucvcn.gov.it
Jun 27, 2025RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.CVE-2025-44163 · Other software · Raspap · reported by MITREMedium 6.3
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
- Product
- Raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 24, 2025WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI.CVE-2025-43877 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 4.8
WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed WebGUI of the product.
- Product
- WRC-1167GHBK2-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host netwoCVE-2025-29266 · Other software · Unraid · reported by MITRECritical 9.6
Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.
- Product
- Unraid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unraid.netedac.dev
Nov 29, 2024In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script.CVE-2024-36622 · Other software · Raspap · reported by MITRECritical 9.8
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.
- Product
- Raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 15, 2024A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical.CVE-2024-2497 · Other software · RaspAP · reported by VulDBMedium 4.7
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtoradah.notion.sitevuldb.com
Mar 11, 2024Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-SitCVE-2024-27902 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
- Product
- SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 8, 2024RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.CVE-2024-28754 · Other software · raspap · reported by MITREHigh 7.5
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.
- Product
- raspap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.CVE-2024-28753 · Other software · Raspap · reported by MITREMedium 6.5
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.
- Product
- Raspap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd CVE-2023-30260 · Other software · Raspap · reported by MITREHigh 8.8
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
- Product
- Raspap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.CVE-2022-29273 · Other software · Netgate · reported by MITREMedium 6.1
pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comdocs.netgate.com
Jan 27, 2023Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGuiCVE-2022-39813 · Other software · Italtel · reported by MITREMedium 6.1
Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary JavaScript. The payload would then be triggered every time an authenticated user browses the page containing it.
- Product
- Netmatch-s CI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jan 27, 2023Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader.CVE-2022-39812 · Other software · Italtel · reported by MITREHigh 7.5
Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server.
- Product
- Netmatch-s CI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jan 27, 2023Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader.CVE-2022-39811 · Other software · Italtel · reported by MITRECritical 9.1
Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
- Product
- Netmatch-s CI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Sep 20, 2021IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page.CVE-2021-29856 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page. IBM X-Force ID: 205685.
- Product
- Tivoli Netcool/OMNIbus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2021raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.CVE-2021-38557 · Other software · Raspap · reported by MITREHigh 8.8
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
- Product
- Raspap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on veCVE-2020-19203 · Other software · Netgate · reported by MITREMedium 5.4
An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgist.github.com
Jul 12, 2021A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4CVE-2020-19201 · Other software · Netgate · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comgist.github.com
Jul 15, 2020Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI).CVE-2020-14722 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.8
Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Communications Broker. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Communications Broker, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Communications Broker accessible data as well as unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Communications Broker. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L).
- Product
- Enterprise Communications Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI).CVE-2020-14721 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.3
Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Communications Broker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Communications Broker accessible data as well as unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Communications Broker. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
- Product
- Enterprise Communications Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI).CVE-2020-14563 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are affected are 3.0.0-3.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Communications Broker. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Communications Broker, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Communications Broker accessible data as well as unauthorized read access to a subset of Oracle Enterprise Communications Broker accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Enterprise Communications Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2020pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.CVE-2020-11457 · Other software · Netgate · reported by MITREMedium 5.4
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 10, 2019PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.CVE-2018-14683 · Other software · Paessler · reported by MITREMedium 6.1
PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.
- Product
- Prtg Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpaessler.compaessler.com
Jan 8, 2018FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.CVE-2014-5334 · Other software · Freenas · reported by Red HatCritical 9.8
FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.
- Product
- Freenas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Aug 19, 2015The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive inCVE-2015-4308 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968.
- Product
- Edge Bluebird Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comsecurityfocus.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone paramCVE-2015-4029 · Other software · Netgate · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgpfsense.org
Apr 10, 2015Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijackCVE-2015-2295 · Other software · Netgate · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 1, 2015Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the CVE-2015-2294 · Other software · Netgate · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firewall_rules.php; (4) queue parameter in an add action to firewall_shaper.php; (5) id parameter in an edit action to services_unbound_acls.php; or (6) filterlogentries_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries_destinationipaddress, (10) filterlogentries_interfaces, (11) filterlogentries_destinationport, (12) filterlogentries_protocolflags, or (13) filterlogentries_qty parameter to diag_logs_filter.php.
- Product
- Pfsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 4, 2015Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.CVE-2014-8617 · Network & remote access · Fortinet · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol.
- Product
- Fortimail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgfortiguard.com
Feb 9, 2015Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web sCVE-2015-1564 · Other software · Plainblack · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field.
- Product
- Webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecupent.com
Jan 30, 2014Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, EdCVE-2012-3000 · Network & remote access · F5 · reported by cret@cert.orgHigh 7.5
Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter.
- Product
- Big-ip Webaccelerator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
May 26, 2010Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the authentication of users for unspecified CVE-2009-4877 · Other software · Plainblack · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.
- Product
- Webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2009Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspeciCVE-2009-2738 · Other software · Freenas · reported by MITREMedium 4.3
Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.
- Product
- Freenas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2009PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows remote attackers to execute arbitrary PHPCVE-2008-6402 · Other software · Muskatli · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mod_dir parameter.
- Product
- Sofi Webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.