Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Feb 3, 2026webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitraryCVE-2020-37080 · Other software · luiswang · reported by VulnCheckHigh 7.2
webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitrary files. Attackers can exploit the vulnerability by manipulating the 'atttmp1' parameter to specify and delete files on the server through an unauthenticated file deletion mechanism.
- Product
- webTareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Dec 22, 2025WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries.CVE-2023-53972 · Other software · luiswang · reported by VulnCheckCritical 9.3
WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.
- Product
- WebTareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Dec 22, 2025WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality.CVE-2023-53971 · Other software · luiswang · reported by VulnCheckHigh 8.7
WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.
- Product
- WebTareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php.CVE-2022-44962 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php.CVE-2022-44961 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple.CVE-2022-44960 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php.CVE-2022-44959 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php.CVE-2022-44957 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php.CVE-2022-44956 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function.CVE-2022-44955 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php.CVE-2022-44954 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php.CVE-2022-44953 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.CVE-2022-44291 · Other software · Webtareas Project · reported by MITRECritical 9.8
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.CVE-2022-44290 · Other software · Webtareas Project · reported by MITRECritical 9.8
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.CVE-2021-36609 · Other software · Webtareas Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 16, 2022Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.CVE-2021-36608 · Other software · Webtareas Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Apr 20, 2022An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.CVE-2021-43481 · Other software · Webtareas Project · reported by MITRECritical 9.8
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combehradtaher.dev
Oct 8, 2021webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, viCVE-2021-41920 · Other software · Webtareas Project · reported by MITREHigh 7.5
webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor_cible, sor_champs, and sor_ordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain access to the webTareas application.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.ion4nj0.github.io
Oct 8, 2021webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions.CVE-2021-41919 · Other software · Webtareas Project · reported by MITREHigh 8.8
webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to exploit the platform by injecting code or malware and, under certain conditions, to execute code on remote user browsers.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.ion4nj0.github.io
Oct 8, 2021webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and acCVE-2021-41918 · Other software · Webtareas Project · reported by MITREMedium 5.4
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.ion4nj0.github.io
Oct 8, 2021webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients sectionCVE-2021-41917 · Other software · Webtareas Project · reported by MITREMedium 5.4
webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and administrators. The affected endpoint is /clients/editclient.php, on the HTTP POST cn parameter.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.ion4nj0.github.io
Oct 8, 2021A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add aCVE-2021-41916 · Other software · Webtareas Project · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.ion4nj0.github.io
Aug 18, 2021Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.CVE-2020-23069 · Other software · Webtareas Project · reported by MITREMedium 6.5
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 17, 2020webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, adCVE-2020-25735 · Other software · Webtareas Project · reported by MITREMedium 6.1
webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comsourceforge.net
Sep 17, 2020webTareas through 2.1 allows files/Default/ Directory Listing.CVE-2020-25734 · Other software · Webtareas Project · reported by MITREMedium 5.3
webTareas through 2.1 allows files/Default/ Directory Listing.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comsourceforge.net
Sep 17, 2020webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.CVE-2020-25733 · Other software · Webtareas Project · reported by MITREHigh 7.5
webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comsourceforge.net
Aug 26, 2020webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."CVE-2020-23660 · Other software · Webtareas Project · reported by MITREMedium 5.4
webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 22, 2020The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.CVE-2020-14973 · Other software · Webtareas Project · reported by MITREMedium 6.1
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourceforge.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.