Stack overflow

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c...

CVE-2022-29398

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c...

CVE-2022-29398

CVE-2022-29398 affects TOTOLINK N600R V4.3.0cu.7647_B20210106. The vulnerability is a stack overflow in the function FUN_0041309c caused by lack of length validation of the File parameter. Impact per sources is a buffer overflow that could be exploited remotely over the network; CVSS metrics indi...

CVE-2021-42645

CMSimpleXH 1.7.4 is affected by a remote code execution RCE vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host...

CVE-2022-29398: Out-of-bounds Write

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c...

CVE-2021-42645: Unrestricted Upload of File with Dangerous Type

CMSimpleXH 1.7.4 is affected by a remote code execution RCE vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host...

CMSimple code-related vulnerabilities

CMSimpleXH is a PHP-based content management system derived from the original CMSimple project and belongs to its offshoot version. CMSimpleXH suffers from a code execution vulnerability that can be exploited by an attacker to upload a PHP load using the File parameter to gain privileges from a...

PT-2022-11650

Name of the Vulnerable Software and Affected Versions CMSimple XH version 1.7.4 Description The issue is a remote code execution vulnerability. To exploit this, an attacker must use the File parameter to upload a PHP payload, which can result in a reverse shell from the vulnerable host...

TOTOLINK N600R Buffer Error Vulnerability

TOTOLINK N600R is a wireless router from Taiwan, China-based Gion Electronics TOTOLINK.A buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which stems from a lack of length validation of the File parameter in the FUN0041309c function. An attacker could exploit this...

PT-2022-19578

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7647 B20210106 Description A stack overflow issue was discovered via the File parameter in the function FUN 0041309c. Recommendations For TOTOLINK N600R version 4.3.0cu.7647 B20210106, consider restricting access...

PT-2022-13669 · WordPress · Simple File List

Name of the Vulnerable Software and Affected Versions: Simple File List WordPress plugin versions up to and including 3.2.7 Description: The issue allows unauthenticated attackers to download arbitrary files due to missing controls in the eeFile parameter found in the /includes/ee-downloader.php...

PT-2022-18973 · Reprise · Reprise License Manager

Name of the Vulnerable Software and Affected Versions: Reprise License Manager version 14.2 Description: The issue is a reflected cross-site scripting vulnerability XSS in the "/goform/rlmswitchr process" file parameter via GET. Authentication is required to exploit this issue. Recommendations: F...

CVE-2021-44127: Undefined Security Weakness

In DLink DAP-1360 F1 firmware version =v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized...

PT-2022-12000

Name of the Vulnerable Software and Affected Versions DLink DAP-1360 F1 versions =v6.10 Description The issue allows an attacker to execute arbitrary system commands using the file parameter when it is set to name=deleteFile after authorization. This is related to the "webupg" binary...

Remote code execution

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

BloofoxCms Cross-Site Scripting Vulnerability

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

CVE-2021-44608: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...