13452 matches found
Sql injection
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
CVE-2021-43700
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
CVE-2021-43700: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
PT-2022-11886
Name of the Vulnerable Software and Affected Versions ApiManager version 1.1 Description An issue was discovered in ApiManager, which is a sql injection vulnerability. This vulnerability can be exploited through the "/index.php?act=api&tag=8" API endpoint. Recommendations For ApiManager version...
CVE-2021-42194
The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...
CVE-2022-25481: Exposure of Resource to Wrong Sphere
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...
ThinkPHP 安全漏洞
ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP Framework v5.0.24, which stems from the lack of configuration of the PATHINFO parameter. An attacker can...
PT-2022-11556
Name of the Vulnerable Software and Affected Versions EyouCms version 1.5.4-UTF8-SP3 Description The issue arises from the wechat return function in /controller/Index.php, which passes user input directly into the simplexml load string function without prohibiting external entities. This triggers...
CVE-2021-42194: Improper Restriction of XML External Entity Reference
The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...
CVE-2022-25481
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...
CVE-2021-45791
CVE-2021-45791 affects Slims8 Akasia 8.3.1. A SQL injection exists in multiple admin modules (bibliography, member_type, user_group, membership index) via the dir parameter, due to insufficient input escaping/validation. Exploitation is described as feasible by remotely authenticated librarian us...
CVE-2021-45786
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...
PT-2022-12406
Name of the Vulnerable Software and Affected Versions maccms version 10 Description The issue allows an attacker to gain privileges by logging in through the /index.php/user/login endpoint, specifically by exploiting the col and openid parameters. Recommendations For maccms version 10, consider...
CVE-2021-45786: Improper Authentication
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...
CVE-2022-25495
The component /jqueryfileupload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file...
CVE-2022-25495: Unrestricted Upload of File with Dangerous Type
The component /jqueryfileupload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file...
PT-2022-17331
Name of the Vulnerable Software and Affected Versions CuppaCMS version 1.0 Description The issue allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file. This is possible due to a flaw in the /jquery file upload/server/php/index.php component. Recommendations...
CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
