Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
59 results · page 1 of 2
Oct 11, 2026Datalist it: Does not sanitize and escape several request parameters before using them to build a SQL queryCVE-2026-89285 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
- Product
- Datalist it
- Affected
- up to 0.0.3
- What to do
- Affects up to 0.0.3. Update Datalist it to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2026webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests.CVE-2026-59157 · Other software · ncarlier · reported by GitHubMedium 6.5
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.
- Product
- webhookd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station lCVE-2026-51745 · Other software · reported by MITREMedium 5.3
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation.CVE-2026-49996 · Other software · freedomofpress · reported by GitHubLow 3.7
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Monkeytype is a minimalistic and customizable typing test.CVE-2026-69183 · Other software · monkeytypegame · reported by GitHubHigh 7.5
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.
- Product
- monkeytype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-48052 · Other software · papra-hq · reported by GitHubMedium 5.4
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-48051 · Other software · papra-hq · reported by GitHubLow 3.5
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Microdot is a minimalistic Python web framework.CVE-2026-42874 · Other software · miguelgrinberg · reported by GitHubLow 3.7
Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks. For a header injection attack through this issue to be possible, an attacker must first infiltrate the client (for example through an independent XSS attack), so that it can send malicious information that is destined to be stored in a cookie by the server on behalf of the victim. An attacker that infiltrates one client can only orchestrate a header injection attack for that client, all other clients that were not infiltrated are safe. This vulnerability is fixed in 2.6.1.
- Product
- microdot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation.CVE-2026-35465 · Other software · freedomofpress · reported by GitHubHigh 7.5
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35462 · Other software · papra-hq · reported by GitHubMedium 4.3
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35461 · Other software · papra-hq · reported by GitHubMedium 5
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35460 · Other software · papra-hq · reported by GitHubMedium 4.3
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes thCVE-2026-23378 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op: [ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 4, 2026Alist is a file list program that supports multiple storages, powered by Gin and Solidjs.CVE-2026-25161 · Other software · AlistGo · reported by GitHubHigh 8.8
Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. This issue has been patched in version 3.57.0.
- Product
- alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Alist is a file list program that supports multiple storages, powered by Gin and Solidjs.CVE-2026-25160 · Other software · AlistGo · reported by GitHubCritical 9.1
Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.
- Product
- alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Monkeytype is a minimalistic and customizable typing test.CVE-2025-66563 · Other software · monkeytypegame · reported by GitHubHigh 7.1
Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).
- Product
- monkeytype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Monkeytype is a minimalistic and customizable typing test.CVE-2025-59838 · Other software · monkeytypegame · reported by GitHubLow 2.4
Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.
- Product
- monkeytype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025Shaarli is a minimalist bookmark manager and link sharing service.CVE-2025-55291 · Other software · shaarli · reported by GitHubHigh 7.1
Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.
- Product
- Shaarli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025Kossy - Minimalist eCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52807 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through <= 1.45.
- Product
- Kossy - Minimalist eCommerce
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update Kossy - Minimalist eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025WordPress 5sterrenspecialist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32114 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-sterrenspecialist allows Reflected XSS.This issue affects WordPress 5sterrenspecialist Plugin: from n/a through <= 1.4.
- Product
- WordPress 5sterrenspecialist
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WordPress 5sterrenspecialist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
- Product
- Minimalistic Event Manager
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x througCVE-2025-0828 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Product Engineering Specialist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24889 · Other software · freedomofpress · reported by GitHubMedium 4.5
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a virtual machine on the SecureDrop Workstation could gain code execution in the `sd-log` virtual machine by sending a specially crafted log entry. The vulnerability is not exploitable remotely and requires an attacker to already have code execution on one of the other virtual machines (VMs) of the system. Due to the Workstation's underlying usage of Qubes for strong isolation, the vulnerability would have allowed lateral movement between any log-enabled VM and the `sd-log` VM, but no further. The SecureDrop workstation collects logs centrally in an isolated virtual machine named `sd-log` for easy export for support and debugging purposes. The `sd-log` VM is completely isolated from the internet and ingests logs via a narrow Qubes RPC policy that allows for specific inter-VM communication via the Xen vchan protocol used by Qubes's qrexec mechanism. A path traversal bug was found in the logic used to choose where to write the log file for a specific
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24888 · Other software · freedomofpress · reported by GitHubHigh 8.1
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine (`sd-app`). SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. The SecureDrop Client runs in a dedicated Qubes virtual machine, named `sd-app`, as part of the SecureDrop Workstation. The private OpenPGP key used to decrypt submissions and replies is stored in a separate virtual machine and never accessed directly. The vulnerability lies in the code responsible for downloading replies. The filename of the reply is obtained from the `Content-Disposition` HTTP header and used to write the encrypted reply on disk. Note that filenames are generated and sanitized server-side, and files are downloaded in an encry
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.CVE-2024-48747 · Other software · alist_project · reported by MITREMedium 6.8
An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.
- Product
- alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024AList is a file list program that supports multiple storages.CVE-2024-47067 · Other software · alist-org · reported by GitHubMedium 5.1
AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.
- Product
- alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Sep 26, 2024LayUI is a native minimalist modular Web UI component library.CVE-2024-47075 · Other software · layui · reported by GitHubMedium 6.4
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.
- Product
- layui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Express.js minimalist web framework for node.CVE-2024-43796 · Other software · expressjs · reported by GitHubMedium 5
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024Monkeytype is a minimalistic and customizable typing test.CVE-2024-41127 · Other software · monkeytypegame · reported by GitHubHigh 8.3
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.
- Product
- monkeytype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members of ea to makCVE-2024-41017 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members of ea to make sure each ea stays within the ealist.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 24, 2024An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information.CVE-2024-37677 · Other software · shenzhenweitillage · reported by MITREHigh 7.5
An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information.
- Product
- access_management_specialist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Express.js minimalist web framework for node.CVE-2024-29041 · Other software · expressjs · reported by GitHubMedium 6.1
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexpressjs.comgithub.com
Nov 27, 2023Medialist: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-5942 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Medialist
- Fixed in
- 1.4.1
- What to do
- Update Medialist to 1.4.1 or newer.
Jun 7, 2023alist <=3.16.3 is vulnerable to Incorrect Access Control.CVE-2023-33498 · Other software · Alistgo · reported by MITREHigh 8.8
alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023An attacker could have positioned a `datalist` element to obscure the address bar.CVE-2023-32212 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
May 23, 2023AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.CVE-2023-31726 · Other software · Alistgo · reported by MITREHigh 7.5
AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Alist v3.4.0 is vulnerable to Directory Traversal,CVE-2022-45969 · Other software · Alistgo · reported by MITRECritical 9.8
Alist v3.4.0 is vulnerable to Directory Traversal,
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.CVE-2022-45970 · Other software · Alistgo · reported by MITREMedium 5.4
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Alist v3.4.0 is vulnerable to File Upload.CVE-2022-45968 · Other software · Alistgo · reported by MITREHigh 8.8
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data.CVE-2022-24833 · Other software · PrivateBin · reported by GitHubHigh 8.2
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.CVE-2021-40645 · Other software · Jfinaloa Project · reported by MITREMedium 6.5
An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.
- Product
- Jfinaloa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.CVE-2022-26197 · Other software · Joget · reported by MITREMedium 5.4
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
- Product
- Joget DX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 11, 2022Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.CVE-2022-26533 · Other software · Alistgo · reported by MITREMedium 6.1
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
- Product
- Alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using aCVE-2021-45342 · Other software · Librecad · reported by MITREHigh 7.8
A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
- Product
- Librecad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Oct 4, 2021Hiredis is a minimalistic C client library for the Redis database.CVE-2021-32765 · Other software · redis · reported by GitHubHigh 8.8
Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.
- Product
- hiredis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2019Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire ProtocolCVE-2013-4104 · Other software · Cryptocat Project · reported by Red HatHigh 7.5
Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol
- Product
- Cryptocat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at CVE-2018-18608 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2018An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing GCVE-2018-6622 · Other software · Trustedcomputinggroup · reported by MITREHigh 7.1
An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0 specification. An abnormal case is not handled properly by this firmware while S3 sleep and can clear TPM 2.0. It allows local users to overwrite static PCRs of TPM and neutralize the security features of it, such as seal/unseal and remote attestation.
- Product
- Trusted Platform Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comusenix.org
Jun 6, 2018node-simple-router is a minimalistic router for Node.CVE-2017-16083 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
- Product
- node-simple-router node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2011-3861 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901
- Fixed in
- 1.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 to 1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.