131 matches found
tpadmin <= 1.3.12 - Remote Code Execution
yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component /public/static/admin/lib/webuploader/0.1.5/server/preview.php. An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to...
PHPJabbers Callback Widget v1.0 - Cross-Site Scripting
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. id: CVE-2023-40755 info: name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site Scripting...
webuploader-0.1.15-Demo
El componente webuploader-v-0.1.15 tiene una vulnerabilidad de subida de archivos no autorizada Introducción: El componente Baidu WebUploader tiene una vulnerabilidad de subida de archivos. Esta vulnerabilidad se debe a que la página de carga del componente WebUploader filtra de forma deficiente...
CVE-2026-64972
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...
CVE-2026-64972 Reflected XSS in ATutor
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...
EUVD-2026-63373
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...
CVE-2026-64972 Reflected XSS in ATutor
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...
CVE-2026-64972
ATutor's preview.php renders the unsanitized "popup" parameter directly into an HTML attribute, allowing an authenticated attacker to break out of the value and inject an event handler (e.g., onload) for reflected XSS. CVSS 4.0 scores 4.8 (Medium). The product is unsupported and unfixed; version ...
CVE-2026-35023 Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php
Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the itemid parameter lacks proper authorization checks. Attackers can enumerate sequential itemid values to access and retrieve image previews from other...
EUVD-2026-5715
A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out...
CVE-2026-2113 yuan1994 tpadmin WebUploader preview.php deserialization
A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out...
CVE-2023-40755
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...
CVE-2025-15426
CVE-2025-15426 affects jackying H-ui.admin up to version 3.1. A flaw in the library file /lib/webuploader/0.1.5/server/preview.php allows unrestricted file uploads via a remotely exploitable path. Public PoC exists; vendor reportedly unresponsive. Impact is described as remote arbitrary file uplo...
CVE-2025-15426 jackying H-ui.admin preview.php unrestricted upload
A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might...
CVE-2025-15426 jackying H-ui.admin preview.php unrestricted upload
A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might...
EUVD-2006-2030
Malware in sbrugna...
EUVD-2016-1948
Malware in sbrugna...
EUVD-2006-2033
Malware in sbrugna...