Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
May 5, 2026A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24.CVE-2026-7834 · Other software · EFM · reported by VulDBHigh 8.9
A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ipTIME NAS1dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04.CVE-2025-50464 · Other software · Iptime · reported by MITREMedium 6.5
A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04. The vulnerability arises due to the unsafe use of the strcpy function to copy attacker-controlled data from the CONTENT_TYPE HTTP header into a fixed-size stack buffer (v8, allocated 8 bytes) without bounds checking. Since this operation occurs before authentication logic is executed, the vulnerability is exploitable pre-authentication.
- Product
- NAS Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlafdrew.github.io
Oct 17, 2022This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products.CVE-2022-23771 · Other software · EFM Networks Co., Ltd · reported by vuln@krcert.or.krHigh 8
This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete user accounts, or to escalate arbitrary user privileges.
- Product
- NAS1dual, NAS2dual, NAS4dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Aug 17, 2022This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS.CVE-2022-23765 · Other software · EFM Networks Co.,Ltd · reported by vuln@krcert.or.krHigh 8
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
- Product
- NAS1dual, NAS2dual, NAS4dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Mar 25, 2022An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual.CVE-2021-26620 · Other software · EFM Networks Co., Ltd · reported by vuln@krcert.or.krHigh 7.5
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
- Product
- ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Nov 30, 2021This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS.CVE-2020-7879 · Other software · EFM networks & multimedia · reported by vuln@krcert.or.krHigh 8.8
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
- Product
- ipTIME C200 IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2021The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code executioCVE-2020-7847 · Other software · EFM Networks · reported by vuln@krcert.or.krHigh 7.4
The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.
- Product
- ipTIME NAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.