Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 ChestnutCMS version 1.5.10 contains a critical SQL injection vulnerability in the admin backend. The vulnerability arises from improper handling of the content parameter in the cms_content tag, which is injected into a SQL query during template rendering. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently available. Join the discussion | CVE Database V5 | 05/07/2026, 00:00:00 UTC Added: 05/07/2026, 14:36:46 UTC |
0 An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function Join the discussion | CVE Database V5 | 02/05/2026, 00:00:00 UTC Added: 02/06/2026, 08:02:00 UTC |
0 A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload of the component Filename Handler. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. Join the discussion | CVE Database V5 | 12/22/2025, 02:32:05 UTC Added: 12/22/2025, 02:48:49 UTC |
0 A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Join the discussion | CVE Database V5 | 11/10/2025, 00:32:06 UTC Added: 11/10/2025, 00:41:29 UTC |
0 File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the base64-encoded image is parsed. For example, given a string like: data:image/html;base64,PGh0bWw+PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPjwvaHRtbD4= the content after the comma is extracted and decoded using Base64.getDecoder().decode(). The substring from the 11th character up to the first occurrence of a semicolon (;) is assigned to the suffix variable (representing the file extension). The decoded content is then written to a file. However, the file extension is not validated, and since this functionality is exposed to the frontend, it poses significant security risks. Join the discussion | CVE Database V5 | 01/06/2025, 00:00:00 UTC Added: 02/25/2026, 21:38:28 UTC |
Showing 1 to 5 of 5 results