UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
353
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. High 7.5

    CVE-2005-2108 · WordPress

    SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.

    Published 5 Jul 2005 · NVD
  2. Medium 4.3

    CVE-2005-2107 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.

    Published 5 Jul 2005 · NVD
  3. Medium 5.0

    CVE-2005-2106 · Drupal

    Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.

    Published 5 Jul 2005 · NVD
  4. Medium 4.3

    CVE-2005-2091 · IBM WebSphere Application Server

    IBM WebSphere 5.1 and WebSphere 5.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebSphere to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a…

    Published 5 Jul 2005 · NVD
  5. Medium 4.3

    CVE-2005-2090 · Apache Tomcat

    Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving…

    Published 5 Jul 2005 · NVD
  6. Medium 4.3

    CVE-2005-2089 · Microsoft IIS

    Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request,…

    Published 5 Jul 2005 · NVD
  7. Medium 4.3

    CVE-2005-2088 · Apache HTTP Server

    The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that…

    Published 5 Jul 2005 · Fixed in 2.0.55 · NVD
  8. High 7.5

    CVE-2005-1921 · Drupal

    Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not…

    Published 5 Jul 2005 · Fixed in 4.5.4, 4.6.2 · NVD
  9. Medium 4.3

    CVE-2005-2021 · cPanel & WHM

    Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page.

    Published 20 Jun 2005 · NVD
  10. Medium 4.3

    CVE-2005-0563 · Microsoft Exchange Server

    Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("jav&#X41sc
ript:") in an IMG tag.

    Published 14 Jun 2005 · NVD
  11. High 7.5

    CVE-2005-1871 · Drupal

    Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not implemented properly."

    Published 9 Jun 2005 · NVD
  12. Medium 4.3

    CVE-2005-1888 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates.

    Published 6 Jun 2005 · NVD
  13. High 7.5

    CVE-2005-1872 · IBM WebSphere Application Server

    Buffer overflow in the administrative console in IBM WebSphere Application Server 5.x, when the global security option is enabled, allows remote attackers to execute arbitrary code.

    Published 3 Jun 2005 · NVD
  14. High 7.5

    CVE-2005-1810 · WordPress

    SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.

    Published 1 Jun 2005 · NVD
  15. Medium 5.1

    CVE-2005-1797 · OpenSSL

    The design of Advanced Encryption Standard (AES), aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations.

    Published 26 May 2005 · NVD
  16. Medium 5.0

    CVE-2005-1739 · ImageMagick

    The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.

    Published 24 May 2005 · NVD
  17. Medium 5.3

    CVE-2005-1688 · WordPress

    Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.

    Published 20 May 2005 · NVD
  18. High 7.5

    CVE-2005-1687 · WordPress

    SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.

    Published 20 May 2005 · NVD
  19. Medium 4.3

    CVE-2005-0040 · DNN Platform

    Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.

    Published 19 May 2005 · NVD
  20. Medium 4.6

    CVE-2005-1636 · MySQL

    mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by modifying the file's contents.

    Published 17 May 2005 · NVD
  21. Low 2.1

    CVE-2005-1410 · PostgreSQL

    The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.

    Published 3 May 2005 · NVD
  22. High 7.5

    CVE-2005-1409 · PostgreSQL

    PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."

    Published 3 May 2005 · NVD
  23. Medium 4.6

    CVE-2005-1392 · phpMyAdmin

    The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script.

    Published 3 May 2005 · NVD
  24. High 7.5

    CVE-2005-1344 · Apache HTTP Server

    Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.

    Published 2 May 2005 · NVD
  25. Medium 4.3

    CVE-2005-1245 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

    Published 2 May 2005 · NVD
  26. High 10.0

    CVE-2005-1177 · Webmin

    Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.

    Published 2 May 2005 · NVD
  27. Medium 5.0

    CVE-2005-1112 · IBM WebSphere Application Server

    IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.

    Published 2 May 2005 · NVD
  28. Medium 6.8

    CVE-2005-1102 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post.

    Published 2 May 2005 · NVD
  29. High 7.5

    CVE-2005-1042 · PHP

    Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.

    Published 2 May 2005 · NVD
  30. Medium 4.3

    CVE-2005-0992 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.

    Published 2 May 2005 · NVD
  31. High 7.5

    CVE-2005-0913 · Smarty

    Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.

    Published 2 May 2005 · NVD
  32. Medium 5.0

    CVE-2005-0808 · Apache Tomcat

    Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

    Published 2 May 2005 · NVD
  33. High 7.5

    CVE-2005-0762 · ImageMagick

    Heap-based buffer overflow in the SGI parser in ImageMagick before 6.0 allows remote attackers to execute arbitrary code via a crafted SGI image file.

    Published 2 May 2005 · NVD
  34. Medium 5.0

    CVE-2005-0760 · ImageMagick

    The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.

    Published 2 May 2005 · NVD
  35. Medium 5.0

    CVE-2005-0738 · Microsoft Exchange Server

    Stack consumption vulnerability in Microsoft Exchange Server 2003 SP1 allows users to cause a denial of service (hang) by deleting or moving a folder with deeply nested subfolders, which causes Microsoft Exchange Information Store service (Store.exe) to hang as a result of a large number of recursive calls.

    Published 2 May 2005 · NVD
  36. Low 2.1

    CVE-2005-0711 · MySQL

    MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.

    Published 2 May 2005 · NVD
  37. Medium 4.6

    CVE-2005-0710 · MySQL

    MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

    Published 2 May 2005 · NVD
  38. Medium 4.6

    CVE-2005-0709 · MySQL

    MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.

    Published 2 May 2005 · NVD
  39. Medium 4.3

    CVE-2005-0682 · Drupal

    Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs.

    Published 2 May 2005 · NVD
  40. Medium 4.6

    CVE-2005-0653 · phpMyAdmin

    phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.

    Published 2 May 2005 · NVD
  41. Low 2.1

    CVE-2005-0596 · PHP

    PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose size is a multiple of the page size.

    Published 2 May 2005 · NVD
  42. High 7.5

    CVE-2005-0567 · phpMyAdmin

    Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.

    Published 2 May 2005 · NVD
  43. High 7.5

    CVE-2005-0560 · Microsoft Exchange Server

    Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote attackers to execute arbitrary code via a crafted X-LINK2STATE extended verb request to the SMTP port.

    Published 2 May 2005 · NVD
  44. Medium 5.0

    CVE-2005-0544 · phpMyAdmin

    phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11)…

    Published 2 May 2005 · NVD
  45. Medium 5.0

    CVE-2005-0536 · MediaWiki

    Directory traversal vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to delete arbitrary files or determine file existence via a parameter related to image deletion.

    Published 2 May 2005 · NVD
  46. Medium 4.3

    CVE-2005-0534 · MediaWiki

    Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allow remote attackers to inject arbitrary web script.

    Published 2 May 2005 · NVD
  47. Medium 5.0

    CVE-2005-0525 · PHP

    The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek.

    Published 2 May 2005 · NVD
  48. Medium 5.0

    CVE-2005-0524 · PHP

    The php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.

    Published 2 May 2005 · NVD
  49. High 8.8

    CVE-2005-0490 · curl

    Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in…

    Published 2 May 2005 · NVD
  50. Medium 5.0

    CVE-2005-0459 · phpMyAdmin

    phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message.

    Published 2 May 2005 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.