Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Jul 28, 2025HTML injection in Vox Media's Chorus CMS.CVE-2025-40730 · Other software · Vox Media · reported by cve-coordination@incibe.esMedium 4.8
HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
- Product
- Chorus CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors.CVE-2024-28297 · Other software · azursoft · reported by MITREHigh 7.5
SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors.
- Product
- myhorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comazursoft.com
Nov 28, 2023The FACSChorus software does not properly assign data access privileges for operating system user accounts.CVE-2023-29066 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comLow 3.2
The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user.CVE-2023-29065 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comMedium 4.1
The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The FACSChorus software contains sensitive information stored in plaintext.CVE-2023-29064 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comMedium 4.1
The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for CVE-2023-29063 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comLow 2.4
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validCVE-2023-29062 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comLow 3.8
The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023There is no BIOS password on the FACSChorus workstation.CVE-2023-29061 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comMedium 5.2
There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports.CVE-2023-29060 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comMedium 5.4
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical.CVE-2018-25070 · Other software · polterguy · reported by VulDBMedium 5.5
A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
- Product
- Phosphorus Five
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2023A vulnerability was found in Pylons horus and classified as problematic.CVE-2014-125056 · Other software · Pylons · reported by VulDBLow 2.6
A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
- Product
- horus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.CVE-2018-17410 · Other software · Horus CMS Project · reported by MITRECritical 9.8
Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.
- Product
- Horus CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlab.insightsecurity.com.brexchange.xforce.ibmcloud.com
Feb 28, 2017Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash)CVE-2017-5982 · Other software · Kodi · reported by MITREHigh 7.5
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
- Product
- Kodi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.