PT-2022-12429

Name of the Vulnerable Software and Affected Versions Terramaster F4-210, F2-210 TOS version 4.2.X 4.2.15-2107141517 Description The issue allows for the execution of arbitrary commands as root by sending specifically crafted input to the "/tos/index.php?app/app start stop" API endpoint...

CVE-2021-45840: Undefined Security Weakness

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending specifically crafted input to /tos/index.php?app/appstartstop...

CVE-2021-45837: Undefined Security Weakness

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending a specifically crafted input to /tos/index.php?app/del...

PT-2022-18421

Name of the Vulnerable Software and Affected Versions GalleryCMS version 2.0 Description A stored cross-site scripting XSS issue exists in the /index.php/album/add endpoint of GalleryCMS, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the album nam...

PT-2022-12426

Name of the Vulnerable Software and Affected Versions Terramaster F4-210, F2-210 TOS version 4.2.15-2107141517 Description An authenticated attacker can execute arbitrary commands as root by injecting a maliciously crafted input in the request through the "/tos/index.php?app/hand app" API endpoin...

CVE-2021-45836: Undefined Security Weakness

An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by injecting a maliciously crafted input in the request through /tos/index.php?app/handapp...

CVE-2021-37293

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

Sql injection

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

Directory traversal

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-37293

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-37291: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

CVE-2021-37293: Improper Limitation of a Pathname to a Restricted Directory

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

PT-2022-10646

Name of the Vulnerable Software and Affected Versions KevinLAB Inc Building Energy Management System 4ST BEMS version 1.0.0 Description An SQL Injection issue exists in the system, specifically through the input id POST parameter in the "index.php" endpoint. This allows for potential exploitation...

PT-2022-10648

Name of the Vulnerable Software and Affected Versions KevinLAB Inc Building Energy Management System 4ST BEMS version 1.0.0 Description A Directory Traversal issue exists via the page GET parameter in index.php. This allows for potential unauthorized access to sensitive files and directories...

Cross site request forgery (csrf)

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

CVE-2022-26180

The CVE-2022-26180 describes a CSRF vulnerability in qdPM 9.2 that can be exploited via the index.php/myAccount/update URI due to lack of CSRF token validation. Impact is high (C/H/I/A = High) with CVSS 3.1 base score 8.8; basic user interaction required (per the NVD entry). Exploitation details ...

CVE-2022-28002

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...

CVE-2022-28002: Files or Directories Accessible to External Parties

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...

CVE-2022-28001: Improper Neutralization of Special Elements used in an SQL Command

Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter...

CVE-2022-27346: Unrestricted Upload of File with Dangerous Type

Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...