73 matches found
CVE-2020-35612
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of modrandomimage lacked input validation, leading to a path traversal vulnerability...
CVE-2020-35612
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of modrandomimage lacked input validation, leading to a path traversal vulnerability...
Path traversal
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of modrandomimage lacked input validation, leading to a path traversal vulnerability...
CVE-2020-35612: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of modrandomimage lacked input validation, leading to a path traversal vulnerability...
CVE-2014-8337: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified...
Directory traversal
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory...
CVE-2019-10945: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory...
CVE-2018-12314
Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...
Cross site scripting
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
CVE-2018-18579
DedeCMS 5.7 SP2 is affected by a reflected XSS vulnerability in the /member/pm.php endpoint, exploitable via the folder parameter. The vulnerable component is DedeCMS’s web interface; input in the folder parameter can be reflected back to the user, enabling arbitrary script/HTML execution in a us...
CVE-2018-9998: Exposure of Sensitive Information to an Unauthorized Actor
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...
CVE-2018-11342
A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...
CVE-2018-6397
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...
Directory traversal
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...
CVE-2018-6397: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...
Cross-site Scripting (XSS)
symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. A flaw in the template/usererror.missingextension.php allows attackers to inject script through the existing-folder parameter...
FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)
FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...
Cross site scripting
Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...
CVE-2017-5542
Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...
CVE-2017-5542
Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...