Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 14, 2026Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.CVE-2026-110467 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 5.3
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 14, 2026Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability.CVE-2026-110466 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 5.3
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 14, 2026Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.CVE-2026-110465 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 5.3
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 5, 2026Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commandCVE-2019-25687 · Other software · wisdom · reported by VulnCheckCritical 9.3
Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.
- Product
- Pegasus CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Feb 22, 2026Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.CVE-2026-2997 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 6.5
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, authenticated remote attackers to modify a specific parameter to obtain a course invitation code, thereby joining any course.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 6, 2025A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4.CVE-2025-11321 · Other software · zhuimengshaonian · reported by VulDBLow 2.1
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- wisdom-education
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4.CVE-2025-11320 · Other software · zhuimengshaonian · reported by VulDBLow 2.1
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- wisdom-education
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4.CVE-2025-11080 · Other software · zhuimengshaonian · reported by VulDBLow 2.1
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoController.java. Such manipulation of the argument subjectId leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- wisdom-education
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specificCVE-2025-10719 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 5.3
Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specific parameter to access other users' files.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 16, 2025A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versiCVE-2025-31340 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.9
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote aCVE-2025-31339 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiMedium 5.3
An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtaCVE-2025-31338 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiMedium 6.9
A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality.
- Product
- Wisdom Master Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2024ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine.CVE-2024-12902 · Other software · Global Wisdom Software · reported by twcert@cert.org.twHigh 8.4
ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials.
- Product
- ANCHOR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 11, 2024An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.CVE-2024-48770 · Other software · starvedia · reported by MITREHigh 8.2
An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.
- Product
- com.wisdomcity.zwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2024The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifCVE-2024-6738 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 5.3
The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.
- Product
- Tronclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 21, 2024MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.CVE-2024-23750 · Other software · Deepwisdom · reported by MITREHigh 8.8
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
- Product
- Metagpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability.CVE-2023-41356 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 6.5
NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.
- Product
- Tronclass ilearn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 27, 2023WisdomGarden Tronclass has improper access control when uploading file.CVE-2023-24834 · Other software · WisdomGarden · reported by twcert@cert.org.twMedium 6.5
WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.
- Product
- Tronclass ilearn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 20, 2022Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.CVE-2021-44345 · Other software · Wvti · reported by MITREHigh 7.5
Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
- Product
- ONE Card Integrated Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnvd.org.cncnvd.org.cn
Sep 30, 2014The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attaCVE-2014-6816 · Other software · Lvtu99 · reported by cret@cert.orgMedium 5.4
The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wisdom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 31, 2002Database of Our Owlish Wisdom (DOOW) 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activitiCVE-2002-2027 · Other software · Doow · reported by MITREHigh 7.5
Database of Our Owlish Wisdom (DOOW) 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities.
- Product
- Doow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprdownloads.sourceforge.netsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.