Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
227 results · page 1 of 5
Oct 28, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56828 · Other software · shopperlabs · reported by GitHubHigh 8.8
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditione
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administratCVE-2026-114387 · Other software · shopperlabs · reported by VulnCheckHigh 8.7
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56826 · Other software · shopperlabs · reported by GitHubMedium 5.4
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Gloria Admin Panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94158 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.
- Product
- Gloria Admin Panel
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Gloria Admin Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postbaCVE-2026-9209 · Other software · mJob · reported by VulnCheckCritical 9.3
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
- Product
- mJobTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmjobtime.comsprocketsecurity.com
Sep 21, 2026Ajenti is a Linux & BSD modular server admin panel.CVE-2026-79920 · Other software · ajenti · reported by GitHubCritical 9.9
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
- Product
- ajenti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56831 · Other software · shopperlabs · reported by GitHubMedium 6.5
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56830 · Other software · shopperlabs · reported by GitHubMedium 6.5
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56829 · Other software · shopperlabs · reported by GitHubHigh 8.1
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56827 · Other software · shopperlabs · reported by GitHubHigh 8.1
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56825 · Other software · shopperlabs · reported by GitHubHigh 8.1
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-53769 · Other software · avo-hq · reported by GitHubMedium 6.5
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all applicCVE-2026-37067 · Other software · reported by MITREMedium 5.3
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass.CVE-2026-16323 · Other software · FuyaWeb Internet and Informatics Services · reported by iletisim@usom.gov.trHigh 7.5
Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026.
- Product
- ArchitectPanel Web Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) fCVE-2026-70376 · Other software · pluck-cms · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.6
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
- Product
- Pluck CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f.CVE-2026-18766 · Other software · chetans9 · reported by VulDBLow 2.1
A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filter_col can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- core-php-admin-panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47743 · Other software · shopperlabs · reported by GitHubHigh 8.7
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marke
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-55518 · Other software · avo-hq · reported by GitHubCritical 9.6
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.CVE-2026-54477 · Other software · Gardyn · reported by ics-cert@hq.dhs.govMedium 5.1
The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
- Product
- Gardyn Home Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-55455 · Other software · appsmithorg · reported by GitHubMedium 5.3
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the HTTP plugin path. As a result, an authenticated user can craft outbound requests that reach loopback-bound services inside the container. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-55454 · Other software · appsmithorg · reported by GitHubCritical 9.9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-50189 · Other software · appsmithorg · reported by GitHubHigh 8.9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup. This vulnerability is fixed in 2.1.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-49979 · Other software · appsmithorg · reported by GitHubMedium 5.1
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47745 · Other software · shopperlabs · reported by GitHubMedium 6.5
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47744 · Other software · shopperlabs · reported by GitHubCritical 9.9
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47742 · Other software · shopperlabs · reported by GitHubMedium 6.5
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47741 · Other software · shopperlabs · reported by GitHubMedium 5.9
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-47740 · Other software · shopperlabs · reported by GitHubHigh 8.1
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.
- Product
- shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-42205 · Other software · avo-hq · reported by GitHubHigh 8.8
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Ajenti is a Linux and BSD modular server admin panel.CVE-2026-35175 · Other software · ajenti · reported by GitHubHigh 7.2
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
- Product
- ajenti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.CVE-2026-29924 · Other software · Getgrav · reported by MITREHigh 7.6
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
- Product
- Grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-33226 · Other software · Budibase · reported by GitHubHigh 8.7
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-33209 · Other software · avo-hq · reported by GitHubMedium 5.3
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate databaCVE-2019-25488 · Other software · Jettweb · reported by VulnCheckHigh 8.8
Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into the 'tur', 'id', and 'ozellikdil' parameters of the admin/index.php endpoint to extract sensitive database information or cause denial of service.
- Product
- Rent A Car Scripti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 10, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-30862 · Other software · appsmithorg · reported by GitHubCritical 9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-31816 · Other software · Budibase · reported by GitHubCritical 9.1
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-30240 · Other software · Budibase · reported by GitHubCritical 9.6
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables — JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-25737 · Other software · Budibase · reported by GitHubHigh 8.9
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI level. An attacker can bypass these restrictions and upload malicious files.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-25045 · Other software · Budibase · reported by GitHubHigh 8.7
Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-25041 · Other software · Budibase · reported by GitHubHigh 8.6
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Ajenti is a Linux and BSD modular server admin panel.CVE-2026-27975 · Other software · ajenti · reported by GitHubHigh 8.1
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.
- Product
- ajenti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-27702 · Other software · Budibase · reported by GitHubCritical 9.9
Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature.CVE-2026-27174 · Other software · sergejey · reported by VulnCheckCritical 9.3
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
- Product
- MajorDoMo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Feb 3, 2026chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php.CVE-2025-70758 · Other software · reported by MITREHigh 7.5
chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The application sends an HTTP redirect via header(Location:login.php) when a user is not authenticated but fails to call exit() afterward. This allows remote unauthenticated attackers to access protected pages.customer database.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Budibase is a low code platform for creating internal tools, workflows, and admin panels.CVE-2026-25040 · Other software · Budibase · reported by GitHubMedium 5.7
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or App Viewer, and assign them to any group in the organization. This allows full privilege escalation, bypassing UI restrictions, and can lead to complete takeover of the workspace or organization. As of time of publication, no known fixed versions are available.
- Product
- budibase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 21, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-24042 · Other software · appsmithorg · reported by GitHubCritical 9.4
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel.CVE-2022-50936 · Other software · Wbce · reported by VulnCheckHigh 8.7
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-22794 · Other software · appsmithorg · reported by GitHubCritical 9.6
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic.CVE-2025-63512 · Other software · Kishan0725 · reported by MITREMedium 6.5
kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it directly into a dynamic SQL query.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.CVE-2025-64281 · Other software · Centralsquare · reported by MITRECritical 9.8
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.