PT-2025-34151 · Unknown · Elunez Eladmin

Name of the Vulnerable Software and Affected Versions: elunez eladmin versions prior to 2.8 Description: A weakness has been identified in the exportUser function, which can lead to CSV injection. The attack can be initiated remotely and the exploit has been made publicly available...

CVE-2024-2564

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2564

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

CVE-2024-2564

CVE-2024-2564 affects PandaXGO PandaX up to 20240310 . The vulnerability is in the function ExportUser (file /apps/system/api/user.go ); manipulating the filename parameter enables a path traversal (e.g., '../filedir'), potentially allowing access to files outside the intended directory. Exploita...

CVE-2024-2564 PandaXGO PandaX user.go ExportUser path traversal

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

PT-2024-21060 · Unknown · Pandaxgo Pandax

Name of the Vulnerable Software and Affected Versions: PandaXGO PandaX up to 20240310 Description: A critical issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal, allowing an attacker to access files outside...

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...