Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Oct 5, 2026Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.CVE-2026-19954 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.4
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler.CVE-2018-25432 · Computers, phones & browsers · Armcode · reported by VulnCheckHigh 8.6
Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through exception handler hijacking.
- Product
- Arm Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmcode.comarmcode.com
Jun 1, 2026Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the ICVE-2018-25427 · Computers, phones & browsers · Armcode · reported by VulnCheckCritical 9.3
Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution when the application processes the input.
- Product
- Arm Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmcode.comarmcode.com
May 30, 2026Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string.CVE-2018-25423 · Computers, phones & browsers · Armcode · reported by VulnCheckMedium 6.9
Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a malicious buffer of 700 bytes into the IP address or domain input field to trigger a denial of service condition.
- Product
- Arm Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarmcode.comarmcode.com
May 13, 2026Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript byCVE-2020-37225 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
- What to do
- Update the plugin to the newest version.
Feb 12, 2026iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input.CVE-2019-25341 · Other software · inettools · reported by VulnCheckMedium 6.7
iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input. Attackers can paste a specially crafted 98-character buffer into the Domain Name field to trigger an application crash.
- Product
- iNetTools for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comexploit-db.com
Sep 19, 2025Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).CVE-2025-57880 · Other software · Hallo Welt! GmbH · reported by security@bluespice.comMedium 5.9
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
- Product
- BlueSpice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical has been found in Furqan node-whois.CVE-2020-36618 · Other software · Furqan · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
- Product
- node-whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2022AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.CVE-2022-46391 · Other software · Awstats · reported by MITREMedium 6.1
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Product
- Awstats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 14, 2022Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.CVE-2022-25800 · Other software · Bestpractical · reported by MITRECritical 9.1
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
- Product
- Request Tracker For Incident Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 29, 2021phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-43698 · Websites & servers · Phpwhois Project · reported by MITREMedium 6.1
phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET['query'] then there is a XSS vulnerability.
- Product
- Phpwhois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line iCVE-2020-14931 · Other software · Dmitry Project · reported by MITRECritical 9.8
A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nic_format_buff.
- Product
- Dmitry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2019The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.CVE-2017-18612 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordrastating.github.iowordpress.org
Aug 20, 2018phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.CVE-2015-5243 · Websites & servers · Phpwhois Project · reported by Red HatCritical 9.8
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
- Product
- Phpwhois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
May 17, 2017Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers toCVE-2015-3998 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
- Product
- adsense-click-fraud-monitoring
- Affected
- 1.7.5 to 1.7.5
- What to do
- Affects 1.7.5 to 1.7.5. Update adsense-click-fraud-monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org
Oct 16, 2014The Who-is-it? Lite name caller time limited free (aka de.profiler.android.whoisit) application 1.0 for Android does not verify X.509 certificates from SSL servCVE-2014-7025 · Other software · Whoisit · reported by cret@cert.orgMedium 5.4
The Who-is-it? Lite name caller time limited free (aka de.profiler.android.whoisit) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Who-is-it? Lite Name Caller Time Limited Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
- Product
- Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
- Fixed in
- 1.4.2.3
- What to do
- Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enablCVE-2011-5193 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
- Product
- Whois Search
- What to do
- Update Whois Search to the newest version.
Full record and what to do →NVD recordsecunia.comsecunia.com
Apr 9, 2011Unspecified vulnerability in lft in pWhois Layer Four Traceroute (LFT) 3.x before 3.3 allows local users to gain privileges via a crafted command line.CVE-2011-0765 · Other software · Pwhois · reported by cret@cert.orgHigh 7.2
Unspecified vulnerability in lft in pWhois Layer Four Traceroute (LFT) 3.x before 3.3 allows local users to gain privileges via a crafted command line.
- Product
- Layer Four Traceroute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2009Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote attackers to inject arbiCVE-2009-4233 · Other software · Youjoomla · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php. NOTE: some of these details are obtained from third party information.
- Product
- YJ Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgsecunia.com
Mar 30, 2009cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.CVE-2008-6556 · Other software · Puppet Master · reported by MITREHigh 10
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.
- Product
- Webutil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Sep 29, 2008Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmCVE-2008-4318 · Other software · Project-observer · reported by MITREHigh 10
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.
- Product
- Observer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comexchange.xforce.ibmcloud.com
Feb 27, 2008Cross-site scripting (XSS) vulnerability in mwhois.php in Matt Wilson Matt's Whois (MWhois) allows remote attackers to inject arbitrary web script or HTML via tCVE-2008-1041 · Other software · Matts Whois · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in mwhois.php in Matt Wilson Matt's Whois (MWhois) allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
- Product
- Matts Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.compacketstormsecurity.org
Feb 20, 2008Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2)CVE-2008-0850 · Other software · Dokeos · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to main/create_course/add_course.php, the (4) Referer HTTP header to index.php, and the (5) X-Fowarded-For HTTP header to main/admin/class_list.php.
- Product
- Dokeos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojects.dokeos.comsecunia.com
Nov 29, 2007kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2)CVE-2007-6176 · Other software · Amensa-soft · reported by MITREHigh 10
kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action.
- Product
- K+b-bestellsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2007Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP parameter.CVE-2007-4334 · Websites & servers · Php-stats · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP parameter.
- Product
- Php-stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2006Multiple cross-site scripting (XSS) vulnerabilities in Particle Soft Particle Whois 1.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) CVE-2006-2965 · Other software · Particle Soft · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Particle Soft Particle Whois 1.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the target parameter in index.php and (2) the "input box."
- Product
- Particle Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Dec 31, 2005Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive iCVE-2005-4699 · Other software · Kimihia · reported by MITREMedium 6.4
Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.
- Product
- Tellme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexploitlabs.com
Oct 20, 2003Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to execute arbitrary code CVE-2003-0709 · Other software · Whois · reported by MITREHigh 7.5
Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to execute arbitrary code via a long command line option.
- Product
- Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2002Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.CVE-2002-1854 · Other software · Rlaj · reported by MITREHigh 10
Rlaj whois CGI script (whois.cgi) 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field.
- Product
- Rlaj Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Dec 23, 2002Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.CVE-2002-1364 · Other software · Ehud Gavron · reported by MITREHigh 7.2
Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.
- Product
- Tracesroute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2001Format string vulnerability in Network Solutions Rwhoisd 1.5.x allows remote attackers to execute arbitrary code via format string specifiers in the -soa commanCVE-2001-0838 · Other software · Network Solutions · reported by MITREHigh 7.5
Format string vulnerability in Network Solutions Rwhoisd 1.5.x allows remote attackers to execute arbitrary code via format string specifiers in the -soa command.
- Product
- Rwhoisd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2001Format string vulnerability in Network Solutions Rwhoisd 1.5.7.2 and earlier, when using syslog, allows remote attackers to corrupt memory and possibly execute CVE-2001-0913 · Other software · Network Solutions · reported by MITREHigh 7.5
Format string vulnerability in Network Solutions Rwhoisd 1.5.7.2 and earlier, when using syslog, allows remote attackers to corrupt memory and possibly execute arbitrary code via a rwhois request that contains format specifiers.
- Product
- Rwhoisd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.research.netsol.commarc.info
Dec 19, 2000Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "whois" parameter.CVE-2000-0941 · Other software · Kootenay Web INC · reported by MITREHigh 10
Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "whois" parameter.
- Product
- Kootenay Web INC Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Jun 1, 2000Buffer overflows in the finger and whois demonstration scripts in Sambar Server 4.3 allow remote attackers to execute arbitrary commands via a long hostname.CVE-2000-0509 · Other software · Sambar · reported by MITREHigh 10
Buffer overflows in the finger and whois demonstration scripts in Sambar Server 4.3 allow remote attackers to execute arbitrary commands via a long hostname.
- Product
- Sambar Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Dec 26, 1999WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.CVE-2000-0010 · Other software · Tony Greenwood · reported by MITREHigh 10
WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
- Product
- Webwho+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 9, 1999Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0984 · Other software · Matts Whois · reported by MITREHigh 7.5
Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- Matts Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 9, 1999CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0985 · Other software · CC · reported by MITREHigh 7.5
CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- CC Whois
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 9, 1999Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.CVE-1999-0983 · Other software · Internic · reported by MITREHigh 7.5
Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry.
- Product
- Whois Lookup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Jun 1, 1999CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.CVE-1999-1063 · Other software · Cdomain · reported by MITREHigh 10
CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter.
- Product
- Cdomainfree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.