Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Oct 16, 2026eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data sCVE-2026-111604 · Other software · elunez · reported by VulnCheckMedium 5.1
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.CVE-2026-106705 · Other software · reported by MITREHigh 8.8
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.systemCVE-2026-106700 · Other software · reported by MITREHigh 8.8
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.CVE-2026-106701 · Other software · reported by MITREMedium 6.1
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stCVE-2026-108706 · Other software · elunez · reported by VulnCheckMedium 5.3
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated CVE-2026-108688 · Other software · elunez · reported by VulnCheckMedium 5.3
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A vulnerability was found in elunez eladmin up to 2.7.CVE-2026-77036 · Other software · elunez · reported by VulDBLow 2.1
A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A weakness has been identified in elunez eladmin up to 2.7.CVE-2026-10550 · Other software · elunez · reported by VulDBLow 2.1
A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Application Deployment Module. This manipulation of the argument uploadPath causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A vulnerability has been found in eladmin up to 2.7.CVE-2026-8127 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpoint. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A vulnerability has been discovered in eladmin v2.7 and before.CVE-2025-70997 · Other software · Eladmin · reported by MITREMedium 6.5
A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level.
- Product
- Eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was identified in elunez eladmin up to 2.7.CVE-2025-10084 · Other software · elunez · reported by VulDBLow 2.1
A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025A flaw has been found in elunez eladmin up to 2.7.CVE-2025-10014 · Other software · elunez · reported by VulDBLow 1.3
A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025A security flaw has been discovered in elunez eladmin 1.1.CVE-2025-9937 · Other software · elunez · reported by VulDBLow 2.1
A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A weakness has been identified in elunez eladmin up to 2.7.CVE-2025-9241 · Other software · elunez · reported by VulDBLow 2.1
A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A security flaw has been discovered in elunez eladmin up to 2.7.CVE-2025-9240 · Other software · elunez · reported by VulDBLow 2.1
A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was identified in elunez eladmin up to 2.7.CVE-2025-9239 · Other software · elunez · reported by VulDBMedium 6.3
A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STR_PARAM with the input Passw0rd leads to inadequate encryption strength. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.CVE-2025-8530 · Other software · elunez · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the component Druid. The manipulation of the argument login-username/login-password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7.CVE-2025-3250 · Other software · elunez · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.CVE-2025-2855 · Other software · elunez · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.CVE-2025-22978 · Other software · Eladmin · reported by MITRECritical 9.8
eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
- Product
- Eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system vCVE-2024-51243 · Other software · eladmin · reported by MITREHigh 7.2
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java.CVE-2024-51242 · Other software · eladmin · reported by MITREMedium 6.5
A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17CVE-2024-48191 · Other software · dingfangzu · reported by MITREMedium 6.3
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17
- Product
- dingfangzu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java cCVE-2024-44677 · Other software · eladmin · reported by MITRECritical 9.8
eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java component.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController.CVE-2024-44676 · Other software · eladmin · reported by MITREMedium 4.8
eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController. java.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2024A vulnerability was found in elunez eladmin up to 2.7 and classified as critical.CVE-2024-7458 · Other software · elunez · reported by VulDBMedium 5.1
A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversal: 'dir/../../filename'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273551.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2016Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmiCVE-2016-2048 · Other software · Djangoproject · reported by MITREMedium 5.5
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.