CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

CVE-2021-24453: Improper Limitation of a Pathname to a Restricted Directory

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

WordPress 路径遍历漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A path traversal vulnerability exists in the WordPress plugin Include Me, which stems from the...

PT-2021-15979

Name of the Vulnerable Software and Affected Versions Include Me WordPress plugin versions 1.2.1 and earlier Description The issue allows for path traversal and local file inclusion, potentially leading to Remote Code Execution RCE of the system due to log poisoning. This could result in a full...

CVE-2020-22609

Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...

CVE-2020-22608

Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...

Enhancesoft osTicket 跨站脚本漏洞

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...

PT-2021-10772

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting XSS vulnerability. It affects the queue-name parameter in the include/class.queue.php file. There is no information provided about the estimated numbe...

CVE-2020-22609: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...

PT-2021-10771

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting vulnerability. It can be exploited via the queue-name parameter to the "/include/ajax.search.php" API endpoint. Recommendations For versions prior to...

Enhancesoft osTicket 跨站脚本漏洞

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/ajax.search.php...

CVE-2020-22608: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...

Command Injection in Centreon

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabasestatuspath via a main.get.php request and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page...

CVE-2020-19510

Textpattern 4.7.3 contains an aribtrary file load via the fileinsert function in include/txpfile.php...

CVE-2020-19510

Textpattern 4.7.3 contains an aribtrary file load via the fileinsert function in include/txpfile.php...

Textpattern 代码问题漏洞

Textpattern is a free open source content management system based on PHP and MySQL. Textpattern has an arbitrary file upload vulnerability. An attacker can use the fileinsert function in include/txpfile.php to upload arbitrary files...

CVE-2020-19510: Unrestricted Upload of File with Dangerous Type

Textpattern 4.7.3 contains an aribtrary file load via the fileinsert function in include/txpfile.php...

PT-2021-10363

Name of the Vulnerable Software and Affected Versions: Textpattern version 4.7.3 Description: The issue concerns an arbitrary file load via the file insert function in include/txp file.php. Recommendations: For Textpattern version 4.7.3, consider disabling the file insert function in include/txp...

WordPress Include Me plugin <= 1.2.1 - Path traversal and Local File Inclusion (LFI) vulnerability leading to Remote Code Execution (RCE)

Path traversal and Local File Inclusion LFI vulnerability leading to Remote Code Execution RCE discovered by Mesut Cetin in WordPress Include Me plugin versions = 1.2.1. Solution Update the WordPress Include Me plugin to the latest available version at least 1.2.2...

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...