Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
152 results · page 1 of 4
Sep 29, 2026A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811.CVE-2026-102292 · Other software · coolbeans1212 · reported by VulDBLow 2.1
A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 6406308df9771d2fd477b56dafe4878dd846df6e. Applying a patch is the recommended action to fix this issue.
- Product
- MateisHomePage-Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /.CVE-2026-86351 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login. The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation. Version affected: ≤2.5.45
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution.CVE-2025-46320 · Other software · Claris · reported by product-security@apple.comMedium 6.1
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
- Product
- FileMaker Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo.CVE-2025-12386 · Other software · Pix-Link · reported by cvd@cert.plMedium 6.9
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- LV-WR21Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 20264images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing funCVE-2022-50806 · Other software · 4Homepages · reported by VulnCheckHigh 8.6
4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.
- Product
- 4images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record4homepages.deexploit-db.com
Aug 1, 2025Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.CVE-2025-51504 · Other software · Microweber · reported by MITREHigh 7.6
Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025BP Profile as Homepage: Cross-Site Request Forgery (CSRF)CVE-2025-49453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through <= 1.1.
- Product
- BP Profile as Homepage
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BP Profile as Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2024A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in theCVE-2024-46475 · Other software · metronic · reported by MITREMedium 4.8
A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
- Product
- metronic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission chCVE-2024-40652 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 23, 2024Homepage is a highly customizable homepage with Docker and service API integrations.CVE-2024-42364 · Other software · gethomepage · reported by GitHubMedium 6.5
Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website.
- Product
- homepage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.com
Aug 20, 2024Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.CVE-2024-39094 · Other software · Friendica · reported by MITREMedium 5.4
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.
- Product
- Friendica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharinCVE-2024-7205 · Other software · CoolKit · reported by 68870bb1-d075-4169-957d-e580b18692b9Critical 9.4
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
- Product
- eWeLink Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execuCVE-2024-29684 · Other software · dedecms · reported by MITRECritical 9.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024All 404 Pages Redirect to Homepage: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24889 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9.
- Product
- All 404 Pages Redirect to Homepage
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update All 404 Pages Redirect to Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Redirect 404 Error Page to Homepage or Custom Page with Logs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47530 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Redirect 404 Error Page to Homepage or Custom Page with Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 17, 2023 A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH).CVE-2023-50271 · Other software · HPE · reported by security-alert@hpe.comHigh 7.2
A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely to disclose information.
- Product
- HPE System Management Homepage (SMH)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jul 12, 2023In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code.CVE-2023-21256 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.CVE-2023-31805 · Other software · Chamilo · reported by MITREMedium 4.8
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Apr 12, 2023Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stCVE-2023-30520 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.
- Product
- Jenkins Quay.io trigger Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 24, 2023In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper input validation.CVE-2023-20960 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-250589026
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.CVE-2022-44585 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugiCVE-2022-30998 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 10, 2022The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31548 · Other software · Homepage Project · reported by MITRECritical 9.3
The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Homepage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user tCVE-2022-26104 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message.
- Product
- SAP Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddam.sap.comlaunchpad.support.sap.com
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Fixed in
- 1.7.9
- What to do
- Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`,CVE-2020-36497 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
May 17, 2021tab parameter of the settings page of the All 404 Redirect to Homepage: Was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issueCVE-2021-24326 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
- Product
- tab parameter of the settings page of the All 404 Redirect to Homepage
- Fixed in
- 1.21
- What to do
- Update tab parameter of the settings page of the All 404 Redirect to Homepage to 1.21 or newer.
May 14, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of cCVE-2020-18167 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".
- Product
- Laobancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" paramCVE-2021-27308 · Other software · 4homepages · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
- Product
- 4images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 26, 20214images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL.CVE-2020-35853 · Other software · 4homepages · reported by MITREMedium 4.8
4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnerability can result in an attacker to inject the XSS payload into the IMAGE URL. Each time a user visits that URL, the XSS triggers and the attacker can be able to steal the cookie according to the crafted payload.
- Product
- 4images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 26, 2021A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function.CVE-2020-24085 · Other software · Misp-project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.CVE-2021-3184 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2020In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.CVE-2020-15711 · Other software · Misp-project · reported by MITREHigh 8.8
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2020In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack.CVE-2020-0051 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138442483
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 2, 2020FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default.CVE-2014-6275 · Other software · Red Hat · reported by security@debian.orgMedium 5.9
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.
- Product
- FusionForge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fusionforge.orgsecurity-tracker.debian.org
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.CVE-2019-19540 · WordPress plugins & themes · reported by MITREMedium 6.1
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
- Product
- ListingPro
- Fixed in
- 2.0.14.2
- What to do
- Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Aug 26, 2019GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_formCVE-2018-18668 · Other software · SIR · reported by MITREMedium 6.1
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2019Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation).CVE-2019-2573 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
- Product
- PeopleSoft Enterprise PT PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.CVE-2018-16727 · Other software · Razorcms · reported by MITREMedium 5.4
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.CVE-2018-16726 · Other software · Razorcms · reported by MITREMedium 5.4
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2018Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description withinCVE-2017-17889 · Other software · Kliqqi · reported by MITREMedium 5.4
Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php.
- Product
- Kliqqi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedricteo.comedricteo.com
Apr 18, 2018Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation).CVE-2018-2809 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
- Product
- PeopleSoft Enterprise PT PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Feb 15, 2018A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12553 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12552 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12551 · Other software · HP · reported by security-alert@hpe.comMedium 5.6
A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local security misconfiguration vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12550 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local security misconfiguration vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12549 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12548 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12547 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 15, 2018A local buffer overflow vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.CVE-2017-12546 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.6
A local buffer overflow vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- Product
- System Management Homepage for Windows and Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.