PT-2024-21503 · Unknown · Campcodes Online Job Finder System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/company/controller.php. The manipulation of the id argument leads to SQL injection. It is...

PT-2024-21466 · Unknown · Campcodes Online Job Finder System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A critical issue affects the processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the EMPLOYEEID argument leads to SQL...

PT-2024-21508 · Unknown · Campcodes Online Job Finder System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown functionality of the file /admin/category/controller.php. The manipulation of the CATEGORYID argument lead...

Gacjie Server Code Issue Vulnerability

Gacjie Server is a platform for monitoring cloud services. A code issue vulnerability exists in Gacjie Server version 1.0 and earlier, which stems from the parameter file in file /app/admin/controller/Upload.php that can lead to unrestricted uploads...

CVE-2024-2406: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...

PT-2024-17667 · Juanpao · Juanpao Jpshop

Name of the Vulnerable Software and Affected Versions: Juanpao JPShop versions up to 1.5.02 Description: A critical issue affects some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the app pic url argument leads to...

PT-2023-29775 · Unknown · Thirty Bees Core

Name of the Vulnerable Software and Affected Versions: Thirty Bees Core version 1.4.0 Description: The issue is a reflected cross-site scripting XSS vulnerability. It allows attackers to execute arbitrary JavaScript in a user's web browser via a crafted payload. The vulnerability is exploited...

PT-2023-22794 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF versions up to 3.0.4 Description: A problematic issue affects the processing of the file app/admin/controller/Ajax.php. The manipulation of the controllername argument leads to path traversal, allowing an attacker to access files using...

CVE-2023-3057: Path Traversal: '../filedir'

A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The...

CVE-2023-30264: Unrestricted Upload of File with Dangerous Type

CLTPHP =6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update...

CLTPHP 代码问题漏洞

CLTPHP is an open source PHP content management system for efficient website building. A security vulnerability exists in CLTPHP 6.0 and earlier versions, which originates from an attacker being able to upload dangerous types of files without restriction via...

CVE-2023-30269: Improper Input Validation

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

The vulnerability of the remote function (application\admin\controller\Upload.php) in the tpAdmin library allows a attacker to perform an SSRF attack.

The vulnerability of the remote function in the application\admin\controller\Upload.php file of the tpAdmin library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack...

Online Ordering System 跨站脚本漏洞

Online Ordering System is a multi-store ordering system for janobe individual developers. It can be used for any small business. A cross-site scripting vulnerability exists in SourceCodester Gadget Works Online Ordering System version 1.0, which stems from a problem with the file...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957: Missing Authorization

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

PT-2022-27637 · Sens · Sens

Name of the Vulnerable Software and Affected Versions: SENS version 1.0 Description: The issue is related to Cross Site Scripting XSS via the com.liuyanzhao.sens.web.controller.admin controller, specifically the getRegister function. This allows for potential malicious script execution...

SENS 跨站脚本漏洞

SENS is an enterprise blog system by saysky individual developer. A cross-site scripting vulnerability exists in SENS v1.0, which originates from a cross-site scripting attack XSS on com.liuyanzhao.sens.web.controller.admin, getRegister...

PT-2022-26790 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job versions prior to 2.3.1 Description: The issue is related to a Server-Side Request Forgery SSRF in the component /admin/controller/JobLogController.java. This allows for potential exploitation. Recommendations: For versions prior to...