Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

39 results

Feb 8, 2023File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the coCVE-2022-45527 · Other software · Institutional Management Website Project · reported by MITRECritical 9.8
File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the courseimg directory.
Product
Institutional Management Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 8, 2023SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to /CVE-2022-45526 · Other software · Institutional Management Website Project · reported by MITRECritical 9.8
SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to /admin_area/login_transfer.php.
Product
Institutional Management Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 5, 2022A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or HTCVE-2022-45990 · Websites & servers · Ecommerce-website Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the eMail parameter.
Product
Ecommerce-website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 22, 2022KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.CVE-2022-42098 · Other software · Klik-socialmediawebsite Project · reported by MITREHigh 8.8
KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.
Product
Klik-socialmediawebsite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 22, 2022A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-40089 · Other software · Simple College Website Project · reported by MITRECritical 9.8
A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploitable when the directive allow_url_include is set to On.
Product
Simple College Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gowthamaraj-rajendran.medium.com sourcecodester.com
Sep 22, 2022Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=.CVE-2022-40088 · Other software · Simple College Website Project · reported by MITREMedium 6.1
Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
Product
Simple College Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gowthamaraj-rajendran.medium.com sourcecodester.com
Sep 22, 2022Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents().CVE-2022-40087 · Other software · Simple College Website Project · reported by MITRECritical 9.8
Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents(). This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Product
Simple College Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gowthamaraj-rajendran.medium.com sourcecodester.com
May 23, 2022In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like FuCVE-2022-30015 · Other software · Simple Food Website Project · reported by MITREMedium 5.4
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
Product
Simple Food Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
May 23, 2022Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account.CVE-2022-30014 · Other software · Simple Food Website Project · reported by MITREHigh 8.8
Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account.
Product
Simple Food Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 3, 2022A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts oCVE-2022-27330 · Websites & servers · E-commerce Website Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
Product
E-commerce Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 8, 2022Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php.CVE-2022-27357 · Websites & servers · Ecommerce-website Project · reported by MITRECritical 9.8
Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Product
Ecommerce-website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Apr 8, 2022Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides.CVE-2022-27346 · Websites & servers · Ecommerce-website Project · reported by MITREHigh 8.8
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Product
Ecommerce-website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Apr 4, 2022A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or CVE-2022-27436 · Websites & servers · Ecommerce-website Project · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field.
Product
Ecommerce-website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com github.com
Apr 4, 2022An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image compoCVE-2022-27435 · Websites & servers · Ecommerce-website Project · reported by MITREHigh 8.8
An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component.
Product
Ecommerce-website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com github.com
Mar 2, 2022Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.CVE-2022-26170 · Other software · Simple Mobile Comparison Website Project · reported by MITRECritical 9.8
Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
Product
Simple Mobile Comparison Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 21, 2022Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admiCVE-2021-44593 · Other software · Simple College Website Project · reported by MITREHigh 8.1
Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php.
Product
Simple College Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2021The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks.CVE-2021-45255 · Other software · Video Sharing Website Project · reported by MITRECritical 9.8
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
Product
Video Sharing Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 26, 2021Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unCVE-2021-22871 · Other software · Revive-adserver · reported by support@hackerone.comMedium 4.8
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.
Product
Revive Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 19, 2019SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.CVE-2018-17840 · Other software · Education Website Project · reported by MITRECritical 9.8
SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.
Product
Education Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 6, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.CVE-2019-7553 · Other software · Chartered Accountant \ · reported by MITREMedium 5.4
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityhitlist.blogspot.com securityhitlist.blogspot.com
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assetsCVE-2018-20638 · Other software · Chartered Accountant \ · reported by MITREMedium 6.5
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavCVE-2018-20637 · Other software · Chartered Accountant \ · reported by MITREMedium 6.5
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavaScript code in the First Name and Last Name field.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.CVE-2018-20636 · Other software · Chartered Accountant \ · reported by MITREMedium 5.4
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Aug 10, 2018PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.CVE-2018-15186 · Other software · Chartered Accountant \ · reported by MITREHigh 8.8
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com gkaim.com
Jul 19, 2018An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03.CVE-2018-14441 · Other software · SSH Companywebsite Project · reported by MITRECritical 9.8
An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type.
Product
SSH Companywebsite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2018An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03.CVE-2018-14440 · Other software · SSH Companywebsite Project · reported by MITRECritical 9.8
An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageAction_queryNotice.action noticeInfo parameter.
Product
SSH Companywebsite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 9, 2018PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.CVE-2018-13256 · Other software · Chartered Accountant \ · reported by MITREMedium 6.1
PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
Product
Auditor Website Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gkaim.com exploit-db.com
Dec 13, 2017CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.CVE-2017-17607 · Other software · CMS Auditor Website Project · reported by MITRECritical 9.8
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
Product
CMS Auditor Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 26, 2009SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in CVE-2008-5977 · Other software · Preprojects · reported by MITREHigh 7.5
SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in a Submit action.
Product
PHP Jobwebsite Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org securityfocus.com
Jan 26, 2009Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary web script or HTML CVE-2008-5976 · Other software · Preprojects · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary web script or HTML via (1) the adname parameter in a Submit action or (2) the UserName field.
Product
PHP Jobwebsite Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com packetstormsecurity.org
Jun 30, 2008SQL injection vulnerability in jobseekers/JobSearch3.php (aka the search module) in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commandsCVE-2008-2914 · Other software · Preprojects · reported by MITREHigh 7.5
SQL injection vulnerability in jobseekers/JobSearch3.php (aka the search module) in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the (1) kw or (2) position parameter. NOTE: some of these details are obtained from third party information.
Product
PHP Jobwebsite Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Dec 31, 2002WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that usCVE-2002-2413 · Other software · Deerfield · reported by MITREMedium 5
WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name.
Product
Website Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com iss.net
Aug 22, 2001Remote manager service in Website Pro 3.0.37 allows remote attackers to cause a denial of service via a series of malformed HTTP requests to the /dyn directory.CVE-2001-0394 · Other software · Oreilly · reported by MITREMedium 5
Remote manager service in Website Pro 3.0.37 allows remote attackers to cause a denial of service via a series of malformed HTTP requests to the /dyn directory.
Product
Website Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Aug 22, 2001O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":" CVE-2001-0626 · Other software · Oreilly · reported by MITREHigh 7.5
O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":" character.
Product
Website Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Oct 20, 2000O'Reilly WebSite Pro 2.3.7 installs the uploader.exe program with execute permissions for all users, which allows remote attackers to create and execute arbitraCVE-2000-0769 · Other software · Oreilly · reported by MITREHigh 7.5
O'Reilly WebSite Pro 2.3.7 installs the uploader.exe program with execute permissions for all users, which allows remote attackers to create and execute arbitrary files by directly calling uploader.exe.
Product
Website Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Jul 19, 2000Buffer overflow in Webfind CGI program in O'Reilly WebSite Professional web server 2.x allows remote attackers to execute arbitrary commands via a URL containinCVE-2000-0622 · Other software · Oreilly · reported by MITREHigh 10
Buffer overflow in Webfind CGI program in O'Reilly WebSite Professional web server 2.x allows remote attackers to execute arbitrary commands via a URL containing a long "keywords" parameter.
Product
Website Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record website.oreilly.com nai.com
Jul 17, 2000Buffer overflow in O'Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or RefeCVE-2000-0623 · Other software · Oreilly · reported by MITREHigh 10
Buffer overflow in O'Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or Referrer header.
Product
Website Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ntbugtraq.com securityfocus.com
Jan 13, 2000WebSite Pro allows remote attackers to determine the real pathname of webdirectories via a malformed URL request.CVE-2000-0066 · Other software · Oreilly · reported by MITREMedium 5
WebSite Pro allows remote attackers to determine the real pathname of webdirectories via a malformed URL request.
Product
Website Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exchange.xforce.ibmcloud.com
Feb 16, 1999O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) aCVE-1999-1180 · Other software · Oreilly · reported by MITREMedium 5
O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat.
Product
Website
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oliver.efri.hr tryc.on.ca

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.