CVE-2022-40475

TOTOLINK A860R V4.1.2cu.5182B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi...

EC-CUBE 跨站脚本漏洞

EC-CUBE is an open source e-commerce system from the Japanese company EC-CUBE. A security vulnerability exists in EC-CUBE versions 4.0.0 through 4.1.2, which stems from a DOM-based cross-site scripting vulnerability that could allow a remote attacker to execute arbitrary script on the...

PT-2022-19753 · Unknown · Qsmart Next

Name of the Vulnerable Software and Affected Versions: Qsmart Next version 4.1.2 Description: A cross-site scripting XSS issue was discovered. This issue allows attackers to inject malicious scripts into websites, potentially leading to unauthorized access or control. Recommendations: For Qsmart...

TOTOLINK A860R 安全漏洞

The TOTOLINK A860R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A860R version V4.1.2cu.5182B20201027, which stems from vulnerability to Cstecgi.cgi buffer overflow...

PowerDNS Recursor DoS Vulnerability (2022-02)

PowerDNS Recursor is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress plugin Team 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user...

Admidio Cross-Site Scripting Vulnerability

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A cross-site scripting vulnerability exists in Admidio version 4.1.2, which stems from the program's lack of checksum filtering of...

Cross-site Scripting in admidio

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

GHSA-QR6M-F3GV-8678 Cross-site Scripting in admidio

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

CVE-2022-23896

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

Cross site scripting

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

CVE-2022-23896

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

CVE-2022-23896

CVE-2022-23896 affects Admidio 4.1.2 with a stored cross-site scripting (XSS) vulnerability. Connected sources indicate the root cause is a lack of checksum filtering of user-supplied data and output, enabling an attacker to execute JavaScript on the client side. Concrete exploit details (vectors...

CVE-2022-23896

Admidio 4.1.2 version is affected by stored cross-site scripting XSS...

Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts...

GHSA-M497-HQ5X-6JCV Mattermost Server allows attackers to create buttons that can launch API requests

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request...

GHSA-G78F-6XQ7-RRHQ Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf...

Mattermost Server does not properly restrict use of slash commands

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...

Mattermost Server allows users with a session ID to revoke another users' session

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...