Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Jun 29, 2023An issue was discovered in Weblib Ucopia before 6.0.13.CVE-2022-44720 · Other software · ucopia · reported by MITRECritical 9.8
An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.
- Product
- weblib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynacktiv.comucopia.com
Jun 29, 2023An issue was discovered in Weblib Ucopia before 6.0.13.CVE-2022-44719 · Other software · ucopia · reported by MITREHigh 7.5
An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.
- Product
- weblib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynacktiv.comucopia.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.7
- What to do
- Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.6
- What to do
- Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.CVE-2017-18538 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.5
- What to do
- Update weblibrarian to 3.4.8.5 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 15, 2019Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection.CVE-2019-1010034 · WordPress plugins & themes · reported by josh@bress.netMedium 6.5
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpvulndb.com
Jul 16, 2012Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTMCVE-2011-4290 · Other software · Moodle · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgmoodle.org
Jun 28, 2010The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote autheCVE-2010-2230 · Other software · Moodle · reported by Red HatMedium 4
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvs.moodle.orgcvs.moodle.org
Apr 29, 2010Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x CVE-2010-1619 · Other software · Moodle · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgmoodle.org
Jan 10, 2005weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.CVE-2004-1222 · Other software · Darryl Burgdorf · reported by MITREHigh 10
weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.
- Product
- Weblibs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Jan 10, 2005Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via ..CVE-2004-1221 · Other software · Darryl Burgdorf · reported by MITREMedium 5
Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via .. sequences in the TextFile parameter.
- Product
- Weblibs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.