Canto <= 1.7.0 - Unauthenticated Blind SSRF

The plugin is affected by Blind SSRF issues via the domain parameter in three files: /includes/lib/tree.php, /includes/lib/detail.php and /includes/lib/get.php. All requests to the arbitrary domain/IP will be made with the HTTPS protocol The PoC will be displayed once the issue has been remediate...

WordPress Canto plugin server-side request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. uninstall is one of the plugins used to completely uninstall WordPress. A server-side request forgery vulnerability exists in the...

CVE-2020-24063

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

CVE-2020-24063

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

Server side request forgery (ssrf)

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

CVE-2020-24063

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

CVE-2020-24063

The CVE-2020-24063 entry concerns the WordPress Canto plugin (version 1.3.0) with a server-side request forgery (SSRF) flaw in includes/lib/download.php?subdomain=. The vulnerability allows an attacker to access internal resources, as described in various sources. The NVD/CVSS data indicates a hi...

SQL Injection Vulnerability in MagazineCantoRequest.aspx of Beijing Jinpan Software Technology Co.

Beijing Jinpan Software Technology Co., Ltd. Jinpan collection query system is a digital library as the framework for building a new type of large-scale system adapted to the operation mechanism of digital libraries. The product MagazineCantoRequest.aspx SQL injection vulnerability exists, the...

Code injection

cantocurses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed...

CVE-2013-7416

cantocurses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed...

CVE-2013-7416

cantocurses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed...

CVE-2013-7416

CVE-2013-7416 affects canto_curses/guibase.py in Canto Curses prior to 0.9.0. The issue allows a remote feed server to execute arbitrary commands via shell metacharacters in a URL contained in a feed. CVSS v2 base score is 7.5 (HIGH) with network access, low attack complexity, and no authenticati...