Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Sep 21, 2026A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656.CVE-2026-94139 · Other software · Chengdu Feiyuxing Technology · reported by VulDBLow 2.1
A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_order.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument session_id causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feiyu Star Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Sep 21, 2026A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656.CVE-2026-94138 · Other software · Chengdu Feiyuxing Technology · reported by VulDBLow 2
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feiyu Star Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Sep 13, 2026A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714.CVE-2026-90508 · Other software · Chengdu Qilu Technology · reported by VulDBLow 1.8
A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ludashi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 13, 2026A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714.CVE-2026-90503 · Other software · Chengdu Qilu Technology · reported by VulDBLow 1.8
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ludashi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit.CVE-2026-73480 · Other software · dundee · reported by VulnCheckMedium 4.8
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
- Product
- gdu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22.CVE-2026-11480 · Other software · Chengdu Everbrite Network Technology · reported by VulDBLow 2.1
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.
- Product
- BeikeShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordanonymous.4open.sciencegithub.com
Jun 7, 2026A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22.CVE-2026-11462 · Other software · Chengdu Everbrite Network Technology · reported by VulDBMedium 5.5
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 6719e0fc690ea0a998452092862e0f0a17c65968. It is suggested to install a patch to address this issue.
- Product
- BeikeShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.CVE-2024-57854 · Other software · DOUGDUDE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.
- Product
- Net::NSCA::Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgpatch-diff.githubusercontent.com
Jul 20, 2025A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2.CVE-2025-7885 · Other software · Huashengdun · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WebSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5.CVE-2024-8165 · Other software · Chengdu Everbrite Network Technology · reported by VulDBLow 2.1
A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This vulnerability affects the function exportZip of the file /admin/file_manager/export. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.6.0 is able to resolve this issue. It is suggested to upgrade the affected component.
- Product
- BeikeShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5.CVE-2024-8164 · Other software · Chengdu Everbrite Network Technology · reported by VulDBLow 2.1
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument new_name causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.6.0 is able to mitigate this issue. The affected component should be upgraded.
- Product
- BeikeShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5.CVE-2024-8163 · Other software · Chengdu Everbrite Network Technology · reported by VulDBLow 2.1
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Affected by this issue is the function destroyFiles of the file /admin/file_manager/files. The manipulation of the argument files results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 1.6.0 can resolve this issue. You should upgrade the affected component.
- Product
- BeikeShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-4172 · Other software · Chengdu · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-4171 · Other software · Chengdu · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-3804 · Other software · Chengdu · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-3803 · Other software · Chengdu · reported by VulDBLow 2.6
A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0.CVE-2023-3802 · Other software · Chengdu · reported by VulDBMedium 5.5
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical.CVE-2023-3798 · Other software · Chengdu · reported by VulDBMedium 5.5
A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flash Flood Disaster Monitoring and Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023A vulnerability classified as problematic was found in Chengdu VEC40G 3.0.CVE-2023-3206 · Other software · Chengdu · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- VEC40G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A vulnerability was found in Chengdu VEC40G 3.0.CVE-2023-2522 · Other software · Chengdu · reported by VulDBMedium 4.7
A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=access_detect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228013 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- VEC40G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic.CVE-2022-4341 · Other software · csliuwy · reported by VulDBLow 3.5
A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /back/index.php/user/User/?1. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215095.
- Product
- coder-chain_gdut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2014The Gangsta Auto Thief III (aka com.apptreestudios.gdup3) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2014-7804 · Other software · Apptreestudios · reported by cret@cert.orgMedium 5.4
The Gangsta Auto Thief III (aka com.apptreestudios.gdup3) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Gangsta Auto Thief III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Apr 7, 2009Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by uploading a file with CVE-2008-6660 · Other software · Ozerov · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by uploading a file with an executable extension followed by a .sql extension, then accessing this file via a direct request. NOTE: some of these details are obtained from third party information.
- Product
- Bigdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.