Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 1 of 2
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.CVE-2026-54866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a craftedCVE-2026-110222 · Other software · Razorpay · reported by VulnCheckMedium 6.9
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host, sending GET requests to internal or attacker-chosen hosts and returning parsed response fields.
- Product
- IFSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to triCVE-2026-104905 · Other software · NeoRazorX · reported by VulnCheckMedium 6.1
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
- Product
- Razorpay for WooCommerce
- Fixed in
- 4.8.8
- What to do
- Update Razorpay for WooCommerce to 4.8.8 or newer.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.CVE-2026-97299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2026Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege EscalationCVE-2026-89426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
- Product
- Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
- Affected
- up to 9.6.1.0
- What to do
- Affects up to 9.6.1.0. Update Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94179 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.CVE-2026-74009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
- Affected
- up to 4.8.7
- What to do
- Affects up to 4.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Razorpay Payment Links for WooCommerce: Missing AuthorizationCVE-2026-57424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.
- Product
- Razorpay Payment Links for WooCommerce
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Razorpay Payment Links for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 23, 2026pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor.CVE-2026-56815 · Other software · rasta-mouse · reported by MITREHigh 7.4
pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor.
- Product
- pwnlift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42877 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42879 · Other software · NeoRazorX · reported by GitHubMedium 6.3
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42878 · Other software · NeoRazorX · reported by GitHubMedium 5.3
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27964 · Other software · NeoRazorX · reported by GitHubLow 3.9
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27892 · Other software · NeoRazorX · reported by GitHubMedium 6.5
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27891 · Other software · NeoRazorX · reported by GitHubHigh 7.2
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-32699 · Other software · NeoRazorX · reported by GitHubMedium 5.3
FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Razorpay for WooCommerce: Missing AuthorizationCVE-2026-39656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Razorpay for WooCommerce: Unauthorized modification of dataCVE-2025-14294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25514 · Other software · NeoRazorX · reported by GitHubHigh 8.7
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25513 · Other software · NeoRazorX · reported by GitHubHigh 8.3
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23997 · Other software · NeoRazorX · reported by GitHubHigh 8
FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23476 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2025-69210 · Other software · NeoRazorX · reported by GitHubLow 1.2
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacturascripts.comgithub.com
Mar 5, 2025Razorpay Subscription Button Elementor: Reflected Cross-Site ScriptingCVE-2024-13827 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Razorpay Subscription Button Elementor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Razorpay Subscription Button Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2025Sale with Razorpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23516 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through <= 1.0.
- Product
- Sale with Razorpay
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Sale with Razorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024Razorpay Payment Button: Reflected Cross-Site ScriptingCVE-2024-10851 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Razorpay Payment Button
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Razorpay Payment Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2024Razorpay Payment Button Elementor: Reflected Cross-Site ScriptingCVE-2024-10850 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Razorpay Payment Button Elementor
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Razorpay Payment Button Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2024SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.phpCVE-2024-28421 · Other software · cobub · reported by MITRECritical 9.8
SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php
- Product
- razor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 14, 2022Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.CVE-2022-37139 · Other software · Razormist · reported by MITREMedium 5.4
Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.
- Product
- Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Sep 14, 2022Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username CVE-2022-37138 · Other software · Razormist · reported by MITRECritical 9.8
Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.
- Product
- Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Aug 30, 2022Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().CVE-2022-36747 · Other software · Cobub · reported by MITREMedium 6.1
Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().
- Product
- Razor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 16, 2022An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.CVE-2022-31295 · Other software · Razormist · reported by MITREHigh 7.5
An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
- Product
- Online Discussion Forum Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 16, 2022An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts.CVE-2022-31294 · Other software · Razormist · reported by MITREMedium 6.5
An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts.
- Product
- Online Discussion Forum Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 16, 2022Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.CVE-2022-31913 · Other software · Razormist · reported by MITREMedium 4.8
Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.
- Product
- Online Discussion Forum Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.CVE-2022-31911 · Other software · Razormist · reported by MITREHigh 7.2
Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
- Product
- Online Discussion Forum Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-2066 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-2065 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.CVE-2022-2016 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.CVE-2022-1988 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1715 · Other software · neorazorx · reported by security@huntr.devCritical 9.8
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1682 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1571 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-1514 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04.CVE-2022-1457 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2022In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if uCVE-2021-46703 · Other software · Razorengine Project · reported by MITRECritical 9.8
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Razorengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2019Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg coCVE-2019-10276 · Other software · Cobub · reported by MITRECritical 9.8
Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type.
- Product
- Razor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.CVE-2018-19906 · Other software · Razorcms · reported by MITREMedium 5.4
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.CVE-2018-19905 · Other software · Razorcms · reported by MITREMedium 5.4
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2018rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.CVE-2018-17986 · Other software · Razorcms · reported by MITREHigh 8.8
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.