884 matches found
Cross site scripting
Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...
iRZ Mobile Routers 跨站脚本漏洞
iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in iRZ Mobile Routers. An attacker could use this vulnerability to obtain sensitive information via the Upload File parameter...
GNU Emacs 命令注入漏洞
GNU Emacs is a family of text editors in the American GNU community. A security vulnerability exists in GNU Emacs version 28.2 and earlier versions, which stems from not escaping the file parameter and the srcdir parameter. An attacker can exploit this vulnerability to execute arbitrary commands...
SUSE CVE-2010-3447
Cross-site scripting XSS vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a viewfile action...
SUSE CVE-2012-3551
Cross-site scripting XSS vulnerability in crowbarframework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils...
SUSE CVE-2017-11630
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
SUSE CVE-2019-10352
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary fil...
SUSE CVE-2019-20378
ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php ce parameter...
Online Food Ordering System 跨站脚本漏洞
Online Food Ordering System is an online food ordering system. A cross-site scripting vulnerability exists in Online Food Ordering System, which is caused by a lack of effective filtering and escaping of user-supplied data in the page parameter of index.php page, which can be exploited by attacke...
Command injection
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function...
CVE-2022-45928
A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content Server evaluates and executes Oscript...
PT-2023-14801 · Opentext · Opentext Content Suite Platform
Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: A remote OScript execution issue was discovered, allowing an attacker to execute OScript code by passing the htmlFile parameter through multiple endpoints. The Content Server...
Online Food Ordering System SQL注入漏洞
Online Food Ordering System is an online food ordering system. an SQL injection vulnerability exists in Online Food Ordering System, which stems from a problem in the unknown section of the file adminclass.php, where an operation on the parameter email can lead to sql injection. No details of the...
WordPress Simple:Press plugin arbitrary file modification vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file...
CVE-2022-4031
The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions...
CVE-2022-4030
The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to...
CVE-2022-4030
The CVE-2022-4030 entry concerns the WordPress Simple:Press plugin (versions up to 6.8). It describes a path-traversal flaw in the file parameter used during user avatar deletion, which could allow an attacker with minimal privileges (e.g., a subscriber) to reference and delete arbitrary server f...
PT-2022-25336 · WordPress · Simple:Press
Name of the Vulnerable Software and Affected Versions: Simple:Press plugin for WordPress versions up to, and including, 6.8 Description: The issue allows attackers with minimal permissions, such as a subscriber, to manipulate the file parameter during user avatar deletion, enabling them to supply...
WordPress plugin Simple:Press 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. WordPress plugin Simple:Press 6.8 and earlier versions have a path traversal vulnerability, which stems...
