PT-2021-21654

Name of the Vulnerable Software and Affected Versions NCH Axon PBX versions 2.22 and earlier Description The issue allows path traversal for file deletion via the logdelete API endpoint with the file parameter set to /... This enables unauthorized file deletion. Recommendations For versions 2.22...

PT-2021-21652

Name of the Vulnerable Software and Affected Versions NCH FlexiServer version 6.00 Description The issue is related to a path traversal vulnerability in the syslog component, where an attacker can potentially access files outside the intended directory by manipulating the file parameter in the...

CVE-2020-23715

Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download...

CVE-2020-23715

Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download...

Directory traversal

Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download...

CVE-2020-23715

Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download...

CVE-2020-23715: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download...

PT-2021-10935

Name of the Vulnerable Software and Affected Versions Webport CMS version 1.19.10.17121 Description The issue is related to a Directory Traversal vulnerability. It can be exploited via the file parameter to the "file/download" endpoint. Recommendations For Webport CMS version 1.19.10.17121, as a...

CVE-2020-20444

Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...

CVE-2020-20444

Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...

Security feature bypass

Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...

CVE-2020-20444

Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...

Jact OpenClinic security vulnerabilities

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in Jact OpenClinic version 0.8.20160412, which could lead to an RCE vulnerability if an attacker logs in...

PT-2021-3440 · Jact · Openclinic

Name of the Vulnerable Software and Affected Versions: Jact OpenClinic version 0.8.20160412 Description: The issue is related to errors in authorization in the shared/view source.php component of the OpenClinic software for managing medical records. An attacker, acting remotely, can exploit this...

CVE-2021-31783

showdefault.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check...

CVE-2021-31783

showdefault.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check...

CVE-2021-31783: Insufficient Verification of Data Authenticity

showdefault.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check...

PT-2021-19504

Name of the Vulnerable Software and Affected Versions Piwigo LocalFilesEditor extension versions prior to 11.4.0.1 Description The issue allows for Local File Inclusion due to the lack of proper validation of the file parameter in the show default.php file. Recommendations For versions prior to...

LocalFilesEditor data manipulation vulnerability

LocalFilesEditor is a software application. Photobooth software for the web, built by an active community of users and developers. A security vulnerability exists in the LocalFilesEditor extension prior to version 11.4.0.1, which stems from a file parameter not being validated by proper regular...

CVE-2021-24154: Files or Directories Accessible to External Parties

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the downloadfile function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd...