Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38 results
Oct 13, 2026Indico is a feature-rich event management system.CVE-2026-108388 · Other software · indico · reported by GitHubLow 3.5
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107397 · Other software · indico · reported by GitHubMedium 4.4
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107396 · Other software · indico · reported by GitHubMedium 5.4
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107395 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107394 · Other software · indico · reported by GitHubMedium 6.8
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-33046 · Other software · indico · reported by GitHubHigh 7.7
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie `XELATEX_PATH` was not set in `indico.conf`), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using `podman`), which isolates it from the rest of the system. As a workaround, remove the `XELATEX_PATH` setting from `indico.conf` (or comment it out or set it to `None`) and restart the `indico-uwsgi` and `indico-celery` services to disable LaTeX functionality.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-28352 · Other software · indico · reported by GitHubMedium 6.5
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0.CVE-2025-56605 · Other software · reported by MITREMedium 5.4
A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0. The mobile POST parameter is improperly validated and echoed back in the HTTP response without sanitization, allowing an attacker to inject and execute arbitrary JavaScript code in the victim's browser.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-25739 · Other software · indico · reported by GitHubMedium 5.4
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the fix itself updating is sufficient, but to benefit from the strict Content Security Policy (CSP) Indico now applies by default for file downloads, update the webserver config in case one uses nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect`. For further directions, consult the GitHub Security advisory or Indico setup documentation. Some workarounds are available. Use the webserver config to apply a strict CSP for material download endpoints, and/or only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-25738 · Other software · indico · reported by GitHubMedium 6.9
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access "special" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery s
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter isCVE-2025-56243 · Other software · Puneethreddyhc · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter is improperly handled. An attacker can craft a malicious URL to execute arbitrary JavaScript in the victim s browser by injecting code into this parameter.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-59035 · Other software · indico · reported by GitHubMedium 4.6
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-59034 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2025-53640 · Other software · indico · reported by GitHubMedium 5.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.getindico.iodocs.getindico.io
Dec 29, 2024A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0.CVE-2024-13007 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0. Affected is an unknown function of the file /contact.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regCVE-2024-44728 · Other software · sourcecodehero · reported by MITREMedium 6.1
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regester.php.
- Product
- event_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.CVE-2024-44727 · Other software · sourcecodehero · reported by MITRECritical 9.8
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
- Product
- event_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2024-45399 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33994 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in '/event/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33993 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33992 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33991 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/eventwinner/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33990 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0.CVE-2024-33989 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' parameters in 'port/event_print.php'.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33988 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33987 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33986 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/department/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33985 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33984 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/index.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33983 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0.CVE-2024-33982 · Other software · Janobe · reported by cve-coordination@incibe.esHigh 7.1
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'StudentID' parameter in '/AttendanceMonitoring/student/controller.php'.
- Product
- School Attendance Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0.CVE-2023-0675 · Other software · Calendar Event Management System Project · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A vulnerability was found in Calendar Event Management System 2.3.0.CVE-2023-0663 · Other software · Calendar Event Management System Project · reported by VulDBHigh 7.3
A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component Login Page. The manipulation of the argument name/pwd leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220175.
- Product
- Calendar Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php.CVE-2022-38323 · Other software · Event Management System Project · reported by MITREHigh 7.2
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.CVE-2022-28080 · Other software · Event Management System Project · reported by MITREHigh 8.8
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
- Product
- Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 16, 2018School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.CVE-2018-18795 · Other software · School Event Management System Project · reported by MITRECritical 9.8
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.CVE-2018-18794 · Other software · School Event Management System Project · reported by MITREHigh 8.8
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 16, 2018School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.CVE-2018-18793 · Other software · School Event Management System Project · reported by MITRECritical 9.8
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
- Product
- School Event Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.