Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 13, 2026A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts.CVE-2026-109189 · Other software · fit2cloud · reported by VulDBLow 2.1
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the argument swaggerUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MeterSphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025MeterSphere is an open source continuous testing platform.CVE-2025-62604 · Other software · metersphere · reported by GitHubMedium 5.3
MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025MeterSphere is an open source continuous testing platform.CVE-2025-53639 · Other software · metersphere · reported by GitHubMedium 5.1
MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024MeterSphere is an open source continuous testing platform.CVE-2024-37161 · Other software · metersphere · reported by GitHubMedium 4
MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024MeterSphere is a test management and interface testing tool.CVE-2024-36118 · Other software · metersphere · reported by GitHubLow 3.5
MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024MeterSphere is an open source continuous testing platform.CVE-2024-32467 · Other software · metersphere · reported by GitHubMedium 5.7
MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from other workspaces beyond their authority. Version 2.10.14-lts fixes this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023MeterSphere is a one-stop open source continuous testing platform.CVE-2023-50267 · Other software · metersphere · reported by GitHubMedium 4.3
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testiCVE-2023-41878 · Other software · metersphere · reported by GitHubMedium 4.6
MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023MeterSphere is an open-source continuous testing platform.CVE-2023-38494 · Other software · metersphere · reported by GitHubMedium 5.9
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Metersphere is an opensource testing framework.CVE-2023-37461 · Other software · metersphere · reported by GitHubMedium 5.6
Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Metersphere is an open source continuous testing platform.CVE-2023-35937 · Other software · metersphere · reported by GitHubMedium 6
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023MeterSphere is an open source continuous testing platform.CVE-2023-32699 · Other software · metersphere · reported by GitHubMedium 6.5
MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2023Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution.CVE-2023-29944 · Other software · Metersphere · reported by MITRECritical 9.8
Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
- Product
- Metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing.CVE-2023-30550 · Other software · metersphere · reported by GitHubMedium 6.8
MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some operating permissions. The issue has been fixed in version 2.9.0.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023metersphere is an open source continuous testing platform.CVE-2023-25814 · Other software · metersphere · reported by GitHubHigh 7.1
metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023metersphere is an open source continuous testing platform.CVE-2023-25573 · Other software · metersphere · reported by GitHubHigh 8.6
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing.CVE-2022-46178 · Other software · metersphere · reported by GitHubHigh 7.4
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing.CVE-2022-23544 · Other software · metersphere · reported by GitHubHigh 7.2
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022MeterSphere is a one-stop open source continuous testing platform.CVE-2022-23512 · Other software · metersphere · reported by GitHubHigh 7.7
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value (testId) in new File(BODY_FILE_DIR + "/" + testId), being deleted later by file.delete(). By adding some camouflage parameters to the url, an attacker can target files on the server. The vulnerability has been fixed in v2.4.1.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022An arbitrary file upload vulnerability was found in Metersphere v1.15.4.CVE-2021-45790 · Other software · Metersphere · reported by MITRECritical 9.8
An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.
- Product
- Metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.CVE-2021-45789 · Other software · Metersphere · reported by MITREMedium 6.5
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.
- Product
- Metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.CVE-2021-45788 · Other software · Metersphere · reported by MITREHigh 8.8
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
- Product
- Metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.