CVE-2021-27341

OpenSIS Community Edition version = 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter...

CVE-2021-27341

OpenSIS Community Edition version = 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter...

CVE-2021-27341

OpenSIS Community Edition

PT-2021-17404

Name of the Vulnerable Software and Affected Versions OpenSIS Community Edition versions prior to 7.7 Description The issue is related to a local file inclusion vulnerability in the DownloadWindow.php file, specifically via the filename parameter. This vulnerability can potentially be exploited t...

CVE-2021-27341: Improper Limitation of a Pathname to a Restricted Directory

OpenSIS Community Edition version = 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter...

OpenSIS 路径遍历漏洞

OpenSIS is the community edition of an open source enterprise content management system from Alfresco Software, Inc. The system includes document management, office collaboration and other features. openSIS Community Edition in versions prior to 7.6 there is a local file inclusion vulnerability,...

CVE-2021-38334

The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. The WordPress plugin WP Design Maps & Places...

WP Design Maps & Places <= 1.2 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts...

CVE-2021-39500

Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories...

CVE-2021-39496

Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into filename param to trigger Reflected XSS...

PT-2021-22592

Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.5.4 Description: The issue is related to a lack of sanitization of input data, allowing an attacker to inject malicious code into the filename parameter to trigger Reflected XSS. Recommendations: For Eyoucms version 1.5.4,...

Eyoucms 路径遍历漏洞

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from a lack of input data validation for the tpldir, filename, type, and nid parameters. An attacker could use this...

EyouCms 跨站脚本漏洞

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from the lack of validation of input data in Eyoucms. An attacker could use this vulnerability to inject malicious cod...

PT-2021-20203

Name of the Vulnerable Software and Affected Versions PEPPERL+FUCHS WirelessHART-Gateway versions 3.0.7 and earlier Description The issue allows for unauthenticated path traversal attacks due to a vulnerability in the filename parameter, enabling read access to arbitrary files on the server. This...

CVE-2021-33555: Improper Limitation of a Pathname to a Restricted Directory

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

PT-2021-22243

Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0 Description A command-injection issue in the Image Upload function allows attackers to execute arbitrary commands as root via shell metacharacters in the filename parameter to "assets/index.php"...

CVE-2021-38611: Improper Neutralization of Special Elements used in a Command

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...