Known vulnerabilities
Critical flaws in the software websites run on, with fixed versions, patch steps and a passive check that reads the versions your site shows.
PHP
- PHP-CGI Argument Injection (CVE-2024-4577): Check Your Site and Patch
CVE-2024-4577 · CVSS 9.8 Actively exploited (CISA KEV)
CVE-2024-4577 lets attackers run code on Windows servers that run PHP in CGI mode. Check which PHP version your site shows, which releases are fixed, and how to patch.
nginx
- nginx DNS Resolver Vulnerability (CVE-2021-23017): Check Your nginx Version
CVE-2021-23017 · CVSS 7.7
A one-byte memory overwrite in the nginx resolver can crash workers or allow code execution when the resolver directive is used. See affected versions and how to update.
Apache
- Apache HTTP Server Path Traversal (CVE-2021-41773, CVE-2021-42013): Check and Patch
CVE-2021-41773, CVE-2021-42013 · CVSS 9.8 Actively exploited (CISA KEV)
Apache 2.4.49 and 2.4.50 let attackers read files outside the web root and, with CGI enabled, run code. Check your Apache version and update to 2.4.51 or later.
Microsoft IIS
- IIS HTTP.sys Remote Code Execution (MS15-034, CVE-2015-1635): What It Means Today
CVE-2015-1635 · CVSS 9.8 Actively exploited (CISA KEV)
MS15-034 lets a single request crash or take over Windows servers running IIS 7.5 to 8.5. Why the IIS version alone cannot confirm the patch, and what to do.
WordPress
- WordPress WP_Query SQL Injection (CVE-2022-21661): Check Your WordPress Version
CVE-2022-21661 · CVSS 7.5
A SQL injection in WP_Query affected WordPress 3.7 to 5.8.2. See which releases are fixed in every branch and how to check the version your site shows.
Joomla
- Joomla API Information Disclosure (CVE-2023-23752): Check and Patch
CVE-2023-23752 · CVSS 5.3 Actively exploited (CISA KEV)
Joomla 4.0.0 to 4.2.7 exposed configuration data, including database credentials, through its web API without login. Update to 4.2.8 or later.
Drupal
- Drupalgeddon2 (CVE-2018-7600): Remote Code Execution in Drupal 7 and 8
CVE-2018-7600 · CVSS 9.8 Actively exploited (CISA KEV)
Drupalgeddon2 lets anyone run code on unpatched Drupal 7 and 8 sites without logging in. Fixed versions, how to check your site and what to do if it ran unpatched.
jQuery
- jQuery XSS (CVE-2020-11022, CVE-2020-11023): Check Your jQuery Version
CVE-2020-11022, CVE-2020-11023 · CVSS 6.1 Actively exploited (CISA KEV)
jQuery before 3.5.0 can run attacker HTML through its DOM methods (cross-site scripting). Check the jQuery version your pages load and how to update safely.