Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Aug 29, 2025A weakness has been identified in mtons mblog up to 3.5.0.CVE-2025-9647 · Other software · mtons · reported by VulDBLow 2.1
A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability was found in mtons mblog up to 3.5.0.CVE-2025-9433 · Other software · mtons · reported by VulDBLow 2.1
A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability has been found in mtons mblog up to 3.5.0.CVE-2025-9432 · Other software · mtons · reported by VulDBLow 2.1
A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Panel. Such manipulation of the argument Title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A flaw has been found in mtons mblog up to 3.5.0.CVE-2025-9431 · Other software · mtons · reported by VulDBLow 2.1
A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability was detected in mtons mblog up to 3.5.0.CVE-2025-9430 · Other software · mtons · reported by VulDBLow 1.9
A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the argument input results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A security vulnerability has been detected in mtons mblog up to 3.5.0.CVE-2025-9429 · Other software · mtons · reported by VulDBLow 2
A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post Handler. The manipulation of the argument content/title/ leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A flaw has been found in mtons mblog up to 3.5.0.CVE-2025-9407 · Other software · mtons · reported by VulDBLow 2
A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulation of the argument signature can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in mtons mblog up to 3.5.0.CVE-2025-9005 · Other software · mtons · reported by VulDBLow 2.9
A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was found in mtons mblog up to 3.5.0.CVE-2025-9004 · Other software · mtons · reported by VulDBLow 2.9
A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability has been found in mtons mblog up to 3.5.0.CVE-2025-8992 · Other software · mtons · reported by VulDBLow 2.1
A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A vulnerability was determined in mtons mblog up to 3.5.0.CVE-2025-8927 · Other software · mtons · reported by VulDBLow 2.9
A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component Verification Code Handler. The manipulation of the argument email leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025WooTumblog: Missing AuthorizationCVE-2025-31729 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooTumblog: from n/a through <= 2.1.4.
- Product
- WooTumblog
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WooTumblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0.CVE-2024-13199 · Other software · langhsu · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file /search of the component Search Bar. The manipulation of the argument kw leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mblog Blog System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0.CVE-2024-13198 · Other software · langhsu · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Mblog Blog System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.CVE-2024-28713 · Other software · mblog_project · reported by MITRECritical 9.8
An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB LoCVE-2023-51062 · Other software · Qstar · reported by MITREMedium 5.3
An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB Log contents via executing a crafted command.
- Product
- Archive Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.CVE-2021-27280 · Other software · Mblog Project · reported by MITREHigh 7.8
OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management.CVE-2021-46028 · Other software · Mblog Project · reported by MITREMedium 4.3
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.CVE-2020-19619 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.CVE-2020-19618 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.CVE-2020-19617 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.CVE-2020-19616 · Other software · Mblog Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2014The Eyvah! Bosandim ozgurum (aka com.wEyvahBosandimBlog) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-thCVE-2014-7697 · Other software · Endulujans · reported by cret@cert.orgMedium 5.4
The Eyvah! Bosandim ozgurum (aka com.wEyvahBosandimBlog) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Eyvah! Bosandim Ozgurum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 9, 2011Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1)CVE-2010-4937 · Other software · Robitbt · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) articleid or (2) catid parameter to index.php.
- Product
- COM Amblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadv.salvatorefresta.netsecunia.com
Oct 7, 2011SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter.CVE-2010-4876 · Other software · Mblogger Project · reported by MITREHigh 7.5
SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter.
- Product
- Mblogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvupen.com
Feb 27, 2009SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.CVE-2008-6322 · Other software · Cfmsource · reported by MITREHigh 7.5
SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
- Product
- Cfmblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
May 13, 2008SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.CVE-2008-2183 · Other software · Toocharger · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
May 13, 2008Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal seCVE-2008-2185 · Other software · Toocharger · reported by MITREMedium 4.3
Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
May 13, 2008Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) mois, (2) an, (3) jourCVE-2008-2184 · Other software · Toocharger · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) mois, (2) an, (3) jour, and (4) id parameters to index.php, and the (5) login parameter to gestion/logon.php, different vectors than CVE-2008-2183. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Dec 28, 2007Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a ..CVE-2007-6582 · Other software · C97net · reported by MITREMedium 6.4
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter in a page mode action.
- Product
- Mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2007Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute arbitrary PHP code in uploadsCVE-2007-3403 · Other software · Dreamlog · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute arbitrary PHP code in uploads/images/ via the uploadedFile[] parameter.
- Product
- Dreamlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Mar 6, 2006PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the CVE-2006-1013 · Other software · Smartblog · reported by MITREHigh 7.5
PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the pg parameter and (2) a query string without a parameter.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.