10897 matches found
Command execution vulnerability in Fusion K2 router at lanset settings page
The Fusion K2 PSG1218 router is a must-have new generation wireless router for entry-level users. The Fusion K2 router suffers from a command execution vulnerability at the lanset settings page. The vulnerability is due to the backend code failing to properly filter user input ipaddr, which can b...
SQL injection vulnerability in QYKCMS background fe***.php page
QYKCMS QYK CMS or QYKCMS for short is a PHP+MySql based website management system. A SQL injection vulnerability exists in the QYKCMS backend fe.php page. An attacker can exploit the vulnerability to obtain sensitive information from the database...
SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2018:2162-1)
This update for cups fixes the following issues: The following security vulnerabilities were fixed : - CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. bsc1061066 bsc1087018 - Fixed a local...
Laoban CMS v2.0 Vulnerabilities in Backend
Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. Laoban CMS v2.0 has a vulnerability in the background. An attacker can exploit the vulnerability to gain unauthorized access...
Arbitrary File Read Vulnerability in Metinfo 6.0.0 Backend
MetInfo is a content management system developed using PHP and Mysql. An arbitrary file read vulnerability exists in the Metinfo version 6.0.0 backend. An attacker can exploit the vulnerability to read sensitive files on a website...
PHPEMS Online Practice Exam System Version 5.0 Logic Flaw Vulnerability in Frontend
PHPEMS online mock exam system is developed based on PHP+Mysql, it is a PHP online mock exam system that supports multiple question types and presentation methods. PHPEMS online mock exam system version 5.0 there is a logic flaw vulnerability in the foreground, attackers can use the vulnerability...
Universal Password Login Vulnerability in Tatsui Import Preamplifier System
Shanghai Chenrui Information Technology Company is a wholly-owned subsidiary of the Third Research Institute of the Ministry of Public Security. With information security as its main business direction, Chenrui is mainly engaged in the development and integration of products in computer network...
metinfo6.0.0后台update注入（三）
...
Weak Password Vulnerability in Tianxing Security One-way Import System Database
Tianxing Security One-way Import System is a network security product of Beijing Tianxing Net Security Information Technology Co., Ltd. for one-way data transmission across security domains. The product consists of importing preamplifier PAS and importing server IAS, which can provide a...
Faraday v3.0 - Collaborative Penetration Test and Vulnerability Management Platform
This new version has made major architectural changes to adapt the software to the new challenges of cybersecurity. It focuses on processing large volumes of data and facilitating user interaction with Faraday in their environment. Faraday just got much faster Architecture changes and a new...
Arbitrary File Deletion Vulnerability in GreenCMS Backend
GreenCMS is an open source content management system written in PHP by Green Shade Studio, which is based on ThinkPHP, the most popular PHP development framework in China. GreenCMS background there are any file deletion vulnerability , attackers can use the vulnerability to delete any file...
CVE-2017-7470
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...
Code Execution Vulnerability in the background of seacms website builder system
seacms is a video-on-demand system based on PHP+MySql technology. There is a code execution vulnerability in the backend of seacms website builder system, which can be exploited by attackers to execute remote code...
Code Execution Vulnerability in Gxlcms News System
Gxlcms News System is a news cms content management system developed in php+mysql. Gxlcms news system has a code execution vulnerability that can be exploited by an attacker to execute remote code...
XYHCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-13984)
XYHCMS is an open source content management system CMS. A cross-site request forgery vulnerability exists in xyhai.php?s=/Auth/addUser URL in XYHCMS version 3.5. A remote attacker can exploit this vulnerability to add a backend administrator account...
Local File Inclusion
October CMS is vulnerable to local file inclusion. The function validatePath in modules/system/classes/MediaLibrary.php does not perform validation of file paths. This allows an attacker to manipulate the folder names with ../ characters through the request headers to retrieve confidential system...
Stored Cross-Site Scripting Vulnerability in PHPMyWind v5.5 Backend
HPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A stored cross-site scripting vulnerability exists in the backend of PHPMyWind v5.5. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in user...
CVE-2018-1999009
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php244 makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...