218 matches found
Car Driving School Management System SQL注入漏洞
Car Driving School Management System is a driving school management system. SQL injection vulnerability exists in Car Driving School Managment System, which originates from /cdsms/classes/Master.php?f=delete The vulnerability is caused by the lack of filtering and escaping of SQL data in the id...
CScms SQL注入漏洞
CScms is a content management system CMS developed on the CI framework. cscms has a security vulnerability that stems from the fact that cscms v4.1 allows SQL injection via the js del function. No detailed vulnerability details are available...
CVE-2021-21908
Specially-crafted command line arguments can lead to arbitrary file deletion. The handledelete function does not attempt to sanitize or otherwise validate the contents of the file parameter passed to the function as argv1, allowing an authenticated attacker to supply directory traversal primitive...
GPAC 资源管理错误漏洞
GPAC is an open source multimedia framework. version 1.1.0 of GPAC contains a security vulnerability that originates from the gfsgcommanddel function in the software and can be exploited to cause segmentation errors and application crashes...
GHSA-2XWQ-H7R9-6W27 Cross-site Scripting in kimai2
Cross site request forgery vulnerability is present in delete functionality of doctor feature. This vulnerability is capable of deleting system logs...
GHSA-8V63-CQQC-6R2C Prototype Pollution in object-path
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'. The del function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like...
Jfinal CMS 路径遍历漏洞
Jfinal CMS is a powerful information consulting website developed in java that uses JFinal as the web framework, beetl for the template engine, mysql for the database, and bootstrap framework for the front-end. improper access control vulnerabilities exist in Jfinal CMS 4.7.1 and earlier versions...
CVE-2020-20290
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability...
CVE-2020-20290
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability...
yccms project 路径遍历漏洞
YCCMS is a Php-based lightweight CMS builder from the Yccms team. YCCMS 3.3 has a path traversal vulnerability, which stems from an error in the judgment of request parameters by the delete, deletesite, and deleteAll functions. No detailed vulnerability details are available...
RGhost: Idor on the DELETE /comments/
Summary: Idor on /comments Steps To Reproduce: Make sure you have 2 different ID's to maintain 2 different session for ensurity 1. The request can be tamper with the ID of different comment both the functions of edit/delete can be used 2. Delete gets hampered with the Captcha which is thrown but...
CVE-2020-12130
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function...
Cross site scripting
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function...
CVE-2020-12130
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function...
CVE-2020-12130
CVE-2020-12130 affects the AirDisk Pro app for iOS (version 5.5.3). The vulnerability is a cross-site scripting (XSS) flaw that can be triggered through the deleteFile parameter of the Delete function, as stated across multiple sources. The exact root cause is described as insufficient validation...
welpwn
This is an exploit module for a vulnerability in a binary, targeting a heap-based overflow in a baby heap implementation. The exploit is designed to execute a shell on the vulnerable system. The exploit uses a combination of alloc, show, and delete functions to manipulate the heap and create a...
VulnCheck KEV: CVE-2020-36852
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazalesdsdeleteentriestablerow function. This makes it possible for...
GPAC code issue vulnerability (CNVD-2020-01651)
GPAC is an open source multimedia framework. A code issue vulnerability exists in the 'GFIPMPXAUTHDelete' function in the odf/ipmpxcode.c file in GPAC versions 0.8.0 and 0.9.0-development-20191109, which arises from a network system or product The vulnerability stems from an improper design or...