FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

CVE-2019-14537

YOURLS: CVE-2019-14537 PoC When you get a valid timestamp you will be able to make requests to the api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats&timestamp=VALIDTIMESTAMP Usage root@kitploit: usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip...

CVE-2022-24990

CVE-2022-24990 描述 - CVE-2022-24990 的 POC：通过 PHP 对象实例化在 TerraMaster TOS 中实现未认证远程命令执行。 - 由 antx 于 2022-04-12 创建。 详情 - 该漏洞允许远程攻击者在目标系统上执行任意命令。 - 该漏洞是由于 api.php 脚本中的 webNasIPS 组件对输入验证不当所致。远程未认证攻击者可以向应用程序传递特制数据，并在目标系统上执行任意命令。 - 成功利用此漏洞可能导致易受攻击的系统被完全攻破。 CVE 严重性 - attackComplexity: LOW -...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFD（反射文件下载）针对 MediaWiki 远程用户可为目标站点创建特制 URL，当目标用户加载该 URL 时，会导致 api.php 脚本下载包含 shell 命令的文件 CVE-2017-8809。该文件将由目标站点提供。 环境 Google Chrome 79.0 MediaWiki 1.29.1 使用方法 1. 运行 root@kitploit: $ docker-compose up 2. 访问攻击页面（http://127.0.0.1:8080/poc.html） 3. 点击“点击此处” 注意 若更改容器端口，请编辑...

EUVD-2026-78864

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...

CVE-2026-19376 Uasoft Badaso File API api.php class permission

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-14482 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an...

CVE-2026-14482

The CVE-2026-14482 entry covers the WordPress plugin “多说社会化评论框” (

UBUNTU-CVE-2026-58028

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php,...

CVE-2025-1186

A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. The exploit has been...

EUVD-2018-8202

Malware in sbrugna...

EUVD-2017-11165

Malware in sbrugna...

EUVD-2018-12584

Malware in sbrugna...

EUVD-2013-1836

Malware in sbrugna...

EUVD-2021-19282

Malware in sbrugna...

EUVD-2018-20707

Malware in sbrugna...

EUVD-2018-6822

Malware in sbrugna...

EUVD-2024-21555

Malicious code in bioql PyPI...

EUVD-2023-58880

Malicious code in bioql PyPI...

EUVD-2021-30593

Malicious code in bioql PyPI...