CVE-2024-2825 lakernote EasyAdmin saveReportFile path traversal

A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The...

CVE-2024-2825

CVE-2024-2825 (lakernote EasyAdmin) : A critical path-traversal vulnerability affects an unknown part of the file /ureport/designer/saveReportFile. Manipulating the file argument enables path traversal (e.g., ../filedir) and can be exploited remotely. Multiple sources confirm the issue for lakern...

CVE-2024-2825 lakernote EasyAdmin saveReportFile path traversal

A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The...

Easyadmin 代码问题漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker personal developer. A code issue vulnerability exists in EasyAdmin version 20240315 and prior versions. An attacker could exploit this vulnerability to perform a server-side request forgery attack...

PT-2024-22365 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A critical vulnerability has been found in lakernote EasyAdmin. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the file argument leads to path...

EasyAdmin 安全漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker individual developers. A security vulnerability exists in EasyAdmin version 20240315 and earlier versions, which stems from path traversal due to incorrect manipulation of the parameter file...

Easyadmin 代码问题漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker individual developers. A code issue vulnerability exists in EasyAdmin version 20240315 and prior versions, which stems from an incorrect manipulation of the parameter url that can lead to server-side request forgery...

PT-2024-22369 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A vulnerability was found in lakernote EasyAdmin, affecting unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be...

Easyadmin 代码问题漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker personal developer. A code issue vulnerability exists in EasyAdmin version 20240315 and prior versions. An attacker exploited the vulnerability to cause xml external entity references...

PT-2024-22372 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A critical issue has been found in lakernote EasyAdmin, affecting some unknown processing of the file "/ureport/designer/saveReportFile". The manipulation leads to server-side request forgery. T...

PT-2024-22378 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin versions up to 20240315 Description: A critical issue was found in the function thumbnail of the file src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The manipulation of the argument url leads to...

Cross-site Scripting (XSS) - Stored in zhongshaofa/easyadmin

Description Stored XSS in FileName allows for arbitrary execution of JavaScript Proof of Concept At Upload Management Upload File Image with filename : Sun'set.jpg Image Upload File https://user-images.githubusercontent.com/31820707/133646077-b6a14692-fea3-4a37-95e7-eb4c4e6f9073.png Image XSS...

CVE-2020-25917

Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser....

CVE-2020-25917

Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser....

CVE-2020-25917

CVE-2020-25917 affects Stratodesk NoTouch Center before 4.4.68. The root cause is Incorrect Access Control allowing a low-privileged user (e.g., a user with “helpdesk” privileges) to perform privileged operations, such as adding a new administrator via easyadmin/user/submitCreateTCUser.do . CVSS ...

Code Execution Vulnerability in EasyAdmin v1.0.8

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. EasyAdmin code execution vulnerability , an attacker can exploit the vulnerability to obtain server privileges...

Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity in easyadmin-extension-bundle...

Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity in easyadmin-extension-bundle...

EasyAdmin view method suffers from SQL injection vulnerability

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. EasyAdmin view method exists SQL injection vulnerability. Attackers can construct a specific URL injection to obtain the database password...

SQL Injection Vulnerability in EasyAdmin /application/index/controller/index.php Page

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. SQL injection vulnerability exists in the EasyAdmin /application/index/controller/index.php page. Attackers can construct a specific URL injection to obtain the...