CVE-2022-24981: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

PT-2022-17028

Name of the Vulnerable Software and Affected Versions JQueryForm.com versions prior to 2022-02-05 Description A reflected cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to "admin.php". This enables attackers to execute...

PT-2022-17029

Name of the Vulnerable Software and Affected Versions JQueryForm.com versions prior to 2022-02-05 Description The issue allows a remote authenticated attacker to access the cleartext credentials of all other form users. The admin.php file contains a hidden base64-encoded string with these...

CVE-2022-24982: Insufficiently Protected Credentials

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

CVE-2022-24677

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

CVE-2022-24677

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

Remote code execution

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

HYBBS 代码问题漏洞

HYBBS is a lightweight community forum program. A code issue vulnerability exists in HYBBS2, which stems from the product Admin.php page not checking for uploaded files during updates. An attacker can use this vulnerability to upload a carefully crafted ZIP archive file. The following products an...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

CVE-2022-24676

CVE-2022-24676 affects HYBBS2 up to version 2.3.2, where the update_code flow in Admin.php allows arbitrary file upload via a crafted ZIP archive. The root cause is described as the Admin.php page not validating uploaded files during updates, enabling potential file upload abuse. Public reference...

CVE-2022-24677

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

CVE-2022-24677

CVE-2022-24677 affects HYBBS2 up to version 2.3.2. Admin.php writes plugin-related configuration information to conf.php, enabling remote code execution. The vulnerability is triggered on the Admin.php page and has been characterized with high/severe impact (NVD CVSS v3.1: 9.8, CRITICAL; v2: 7.5,...

CVE-2022-24677

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

CVE-2022-24677: Undefined Security Weakness

Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...

PT-2022-16794

Name of the Vulnerable Software and Affected Versions HYBBS2 versions 2.3.2 and earlier Description The issue allows remote code execution because it writes plugin-related configuration information to conf.php. This is due to a problem in Admin.php. Recommendations For HYBBS2 versions 2.3.2 and...

CVE-2022-24676: Unrestricted Upload of File with Dangerous Type

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

PT-2022-16793

Name of the Vulnerable Software and Affected Versions HYBBS2 versions 2.3.2 and earlier Description The issue allows for arbitrary file upload via a crafted ZIP archive. This is possible due to a problem in the update code function in Admin.php. Recommendations For HYBBS2 versions 2.3.2 and...

Arbitrary file deletion

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...