CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

CVE-2024-42718

CVE-2024-42718 affects Croogo CMS 4.0.7 and is a path-traversal vulnerability that allows remote attackers to read arbitrary files via a crafted value in the edit-file parameter. The issue is documented across multiple feeds (Red Hat, CIRCL, OSV, NVD, etc.) with the same description. The CVE entr...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

EUVD-2015-1196

Malware in sbrugna...

EUVD-2021-1342

Malware in sbrugna...

EUVD-2022-3361

Malicious code in bioql PyPI...

EUVD-2022-1310

Malicious code in bioql PyPI...

EUVD-2022-5299

Malicious code in bioql PyPI...

EUVD-2022-2122

Malicious code in bioql PyPI...

EUVD-2024-47705

Malicious code in bioql PyPI...

EUVD-2022-5626

Malicious code in bioql PyPI...

EUVD-2022-4895

Malicious code in bioql PyPI...

EUVD-2022-5086

Malicious code in bioql PyPI...

CVE-2024-6647

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is...

CVE-2019-7170

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Host Header Injection

Overview croogo/croogo is an Open Source CMS built for everyone. Affected versions of this package are vulnerable to Host Header Injection in the feed.rss component, which takes the content of the -H argument in a request and passes it through to the element in a response without filtering. An...

croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

GHSA-847X-X4JG-6GF4 croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

CVE-2024-29643

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...