CVE-2026-55584

CVE-2026-55584 - Bypass de la lista de permitidos de IP de phpSysInfo CWE-290, CVSS 7.5 Alta, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resuelve la IP del cliente a partir de las cabeceras controladas por el atacante X-Forwarded-For luego Client-IP antes de recurrir a...

CVE-2025-69212-PoC

CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — Inyección de comandos del sistema operativo a través de un nombre de archivo .p7m malicioso en la carga ZIP. Archivo: src/Util/XML.php:100 — $file sin sanitizar en exec Vector: /plugins/importFEZIP/actions.php → ZI...

PT-2026-94253

Name of the Vulnerable Software and Affected Versions sachertortephp affected versions not specified Description A logic error exists in the Xml::build static method within the lib/Cake/Utility/Xml.php file. The issue stems from incorrect operator precedence in a conditional statement intended to...

CVE-2026-41936: Improper Restriction of XML External Entity Reference

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

CVE-2017-20212: Improper Limitation of a Pathname to a Restricted Directory

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile function to access...

CVE-2017-20212

The CVE-2017-20212 entry concerns FLIR Thermal Camera F/FC/PT/D firmware 8.0.0.64. Affected component: the web application path /var/www/data/controllers/api/xml.php, where readFile() reads local files without authentication. Root cause: unverified input parameters allow information disclosure. I...

EUVD-2009-4825

Malware in sbrugna...

Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...

GHSA-67GV-XRW7-P72W Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

phpSysInfo security vulnerability

phpSysInfo is phpSysInfo open source a customizable PHP script that does a great job of displaying information about your system. A security vulnerability exists in phpSysInfo version 3.4.3, which stems from a cross-site request forgery in XML.php...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

CVE-2023-49006 affects Phpsysinfo 3.4.3 and is a Cross-Site Request Forgery (CSRF) vulnerability. The claim states that a crafted page in XML.php can cause a remote attacker to obtain sensitive information. Affected component is Phpsysinfo (XML.php as the attack surface); root cause is CSRF, enab...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

XML.php JSONP hijacking

Description The XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker. Proof of Concept We created an HTML file as a proof of concept to showcase the vulnerability. This HTML file will...