Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
203 results · page 1 of 5
Oct 16, 2026bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other uCVE-2026-111639 · Other software · mlogclub · reported by VulnCheckHigh 8.6
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
- Product
- bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart CVE-2026-110103 · Other software · mlogclub · reported by VulnCheckMedium 5.1
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.
- Product
- bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit.CVE-2026-106436 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.3
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
- Product
- PHP Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission ruCVE-2026-103396 · Other software · mlogclub · reported by VulnCheckMedium 5.3
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
- Product
- bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefCVE-2026-93395 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 6.9
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.
- Product
- C Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0.CVE-2026-90563 · Other software · maliangnansheng · reported by VulDBMedium 5.1
A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.
- Product
- bbs-springboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026BBS e-Franchise 1.1.1: SQL injectionCVE-2016-20072 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
- Product
- BBS e-Franchise 1.1.1
- What to do
- Update BBS e-Franchise 1.1.1 to the newest version.
Full record and what to do →NVD recordlenonleite.com.brwordpress.org
Mar 20, 2026A security flaw has been discovered in atjiu pybbs 6.0.0.CVE-2026-4495 · Other software · atjiu · reported by VulDBLow 2
A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Mar 20, 2026A vulnerability was identified in atjiu pybbs 6.0.0.CVE-2026-4494 · Other software · atjiu · reported by VulDBLow 2
A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Jan 22, 2026Pondol BBS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49336 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS pondol-bbs allows Stored XSS.This issue affects Pondol BBS: from n/a through <= 1.1.8.4.
- Product
- Pondol BBS
- Affected
- up to 1.1.8.4
- What to do
- Affects up to 1.1.8.4. Update Pondol BBS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2025An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13).CVE-2025-63807 · Other software · 2dogz · reported by MITRECritical 9.8
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful exploitation may result in account takeover via password reset or other authentication bypass methods.
- Product
- Blogin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was detected in atjiu pybbs up to 6.0.0.CVE-2025-12297 · Other software · atjiu · reported by VulDBLow 2.1
A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_commCVE-2025-60859 · Other software · SIR · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcreeperkirby.notion.sitegithub.com
Oct 23, 2025gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.CVE-2025-61464 · Other software · SIR · reported by MITREMedium 6.5
gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A weakness has been identified in diyhi bbs up to 6.8.CVE-2025-9461 · Other software · diyhi · reported by VulDBLow 2.1
A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePackageManageAction.java of the component File Compression Handler. This manipulation of the argument idGroup causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
- Product
- bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8814 · Other software · atjiu · reported by VulDBLow 2.1
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8813 · Other software · atjiu · reported by VulDBLow 2
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8812 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8555 · Other software · atjiu · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0.CVE-2025-8554 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0.CVE-2025-8553 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0.CVE-2025-8552 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8551 · Other software · atjiu · reported by VulDBLow 2
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list. The manipulation of the argument Username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8550 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8549 · Other software · atjiu · reported by VulDBLow 2.9
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8548 · Other software · atjiu · reported by VulDBLow 2.9
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical.CVE-2025-8547 · Other software · atjiu · reported by VulDBMedium 5.5
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 044f22893bee254dc2bb0d30f614913fab3c22c2. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8546 · Other software · atjiu · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Bluebird devices contain a pre-loaded barcode scanner application.CVE-2025-5346 · Other software · Bluebird · reported by cvd@cert.plMedium 5.1
Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file. This issue affects all versions before 1.3.3.
- Product
- kr.co.bluebird.android.bbsettings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025A vulnerability was found in letseeqiji gorobbs up to 1.0.8.CVE-2025-7450 · Other software · letseeqiji · reported by VulDBLow 2.1
A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- gorobbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.CVE-2024-37658 · Other software · SIR · reported by MITREMedium 6.1
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.CVE-2024-37657 · Other software · SIR · reported by MITREMedium 6.1
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability classified as critical has been found in diyhi bbs up to 6.8.CVE-2025-6762 · Other software · diyhi · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2025A vulnerability classified as critical has been found in diyhi bbs 6.8.CVE-2025-6453 · Other software · diyhi · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.CVE-2025-40906 · Other software · MONGODB · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.
- Product
- BSON::XS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgmongodb.com
Apr 20, 2025A vulnerability was found in kuangstudy KuangSimpleBBS 1.0.CVE-2025-3830 · Other software · kuangstudy · reported by VulDBMedium 5.3
A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the file src/main/java/com/kuang/controller/QuestionController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- KuangSimpleBBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic.CVE-2025-3808 · Other software · zhenfeng13 · reported by VulDBMedium 5.3
A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
- Product
- My-BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0.CVE-2025-3807 · Other software · zhenfeng13 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- My-BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final CVE-2025-0755 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
- Product
- libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Jul 3, 2024The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and CVE-2024-6383 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 5.3
The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1
- Product
- libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Jul 2, 2024The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative ofCVE-2024-6381 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
- Product
- libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Jun 13, 2024BBS e-Popup: Missing AuthorizationCVE-2023-36504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
- Product
- BBS e-Popup
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update BBS e-Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00.CVE-2024-28126 · Other software · Zerochannel · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using 0ch BBS Script ver.4.00.
- Product
- 0ch BBS Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and escCVE-2023-51939 · Other software · Relic Project · reported by MITREHigh 8.8
An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and escalate privileges via the cp_bbs_sig function.
- Product
- Relic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 23, 2024Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.CVE-2024-22490 · Other software · Beetl-bbs Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.
- Product
- Beetl-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter.CVE-2024-22491 · Other software · Beetl-bbs Project · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter.
- Product
- Beetl-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0.CVE-2022-4959 · Other software · qkmc-rk · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250237 was assigned to this vulnerability.
- Product
- redbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0.CVE-2022-4958 · Other software · qkmc-rk · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation of the argument title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250236.
- Product
- redbbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.CVE-2023-51049 · Other software · S-cms · reported by MITRECritical 9.8
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.
- Product
- S-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Cross Site Scripting vulnerability in mlogclub bbs-go v.CVE-2023-36223 · Other software · Bbs-go · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.
- Product
- Bbs-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.