PT-2024-11528 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress versions up to, and including 3.3.3 Description: The issue concerns deserialization of untrusted input via the uploadfile parameter. This allows...

TOTOLINK AC1200 T8 UploadCustomModule function buffer overflow vulnerability

The TOTOLINK AC1200 T8 is a dual-band full gigabit router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in the TOTOLINK AC1200 T8 UploadCustomModule function. The vulnerability stems from the failure of the File parameter of the UploadCustomModule function to...

CVE-2024-46424

TOTOLINK AC1200 T8 v4.1.5cu.861B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service DoS via the File parameter...

PT-2024-31986 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.861 B20230220 Description: The issue is a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service DoS via the File parameter. This vulnerability...

ABCD2 跨站脚本漏洞

ABCD2 is an ABCD open source software suite for library and documentation center automation. A cross-site scripting vulnerability exists in ABCD2 2.2.0-beta-1 and earlier versions, which stems from some unknown handling of the file /buscarintegrada.php, where manipulation of the parameter...

Webmin Edit_html.cgi File Parameter Traversal Arbitrary File Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin edithtml.cgi file Parameter Traversal Arbitrary File Access', 'Description' = %q This module exploits a directory traversal in Webmin 1.58...

PT-2024-38633 · Sonaar · Mp3 Audio Player – Music Player

Name of the Vulnerable Software and Affected Versions: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress versions up to, and including, 5.7.0.1 Description: The issue is related to unauthorized arbitrary file deletion due to a missing capability check on t...

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute any arbitrary JavaScript code in the user’s browser remotely...

itsourcecode Laravel Property Management System 代码问题漏洞

Laravel Property Management System is itsourcecode open source property management system. A code issue exists in version 1.0 of itsourcecode Laravel Property Management System due to an unlimited upload vulnerability in the file parameter of the PropertiesController.php page...

PT-2024-38070 · WordPress · Lh Add Media From Url

Name of the Vulnerable Software and Affected Versions: LH Add Media From Url plugin for WordPress versions up to, and including, 1.23 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacke...

CVE-2024-7750

A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicinename leads to sql injection. The attack can be launche...

PT-2024-38551 · Wanglongcn · Ltcms

Name of the Vulnerable Software and Affected Versions: wanglongcn ltcms version 1.0.20 Description: A critical issue has been found, affecting the downloadUrl function of the /api/file/downloadUrl API Endpoint. The manipulation of the file argument leads to server-side request forgery, which can ...

Wanglong LTcms 路径遍历漏洞

Wanglong LTcms is an enterprise website builder from China NetDragon Wanglong. A path traversal vulnerability exists in Wanglong LTcms version 1.0.20, which stems from an incorrect operation of the parameter file that can lead to path traversal...

Security Bulletin: IBM Transformation Extender Advanced v10.0.x is affected by a vulnerability in its dependencies

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to Unix File Parameter Alteration Vulnerability Details CVEID:CVE-2020-3452 DESCRIPTION: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software could allow a remote...

The vulnerability of the UploadCustomModule (/cgi-bin/cstecgi.cgi) function in the TOTOLINK A3300R router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the UploadCustomModule /cgi-bin/cstecgi.cgi function in the TOTOLINK A3300R router microprogramming software arises due to an overflow of the buffer on the stack during the processing of the File parameter. Exploiting this vulnerability allows a malicious actor to compromise...

Alien ALR-F800 操作系统命令注入漏洞

The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from the uploadedFile parameter in the /admin/system.html file containing an operating system command injection...

Alien ALR-F800 操作系统命令注入漏洞

The Alien ALR-F800 is an RFID sensor from Alien. An operating system command injection vulnerability exists in the Alien ALR-F800 version 19.10.24.00 and prior versions, which stems from an operating system command injection vulnerability contained in the uploadedFile parameter in the File Name...

The vulnerability of the hfy-istext-command function in the EMACS text editor allows a hacker to execute arbitrary code.

The vulnerability of the hfy-istext-command function in the EMACS text editor is related to improper escaping of output data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the parameters “file” and “srcdir”...

TOTOLINK CP900 安全漏洞

The TOTOLINK CP900 is a wireless router. The TOTOLINK CP900 suffers from a buffer overflow vulnerability that stems from improper handling of the File parameter in the UploadCustomModule function of the file /cgi-bin/cstecgi.cgi. An attacker can use this vulnerability to cause a crash of the...

CVE-2024-7331

A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched remotely. The explo...