Arbitrary file upload vulnerability in layui

layui is a front-end UI framework written using its own module specification , follow the native HTML/CSS/JS writing and organization . An arbitrary file upload vulnerability exists in layui, which can be exploited by an attacker to gain control of the server...

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities

Beginning in January 2021, Mandiant Managed Defense observed multiple instances of abuse of Microsoft Exchange Server within at least one client environment. The observed activity included creation of web shells for persistent access, remote code execution, and reconnaissance for endpoint securit...

Unauthorized access vulnerability in songcms front-end

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. An unauthorized access vulnerability exists in the front-end page of SongCMS. An attacke...

Logic Flaw Vulnerability in Songcms Front-End Pages

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A logic vulnerability exists in the front-end page of SongCMS. An attacker can exploit...

MCMS suffers from a file upload vulnerability (CNVD-2021-03299)

MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCMS has a file upload vulnerability that can be exploited by an attacker to gain control of the server...

Logic Flaw Vulnerability in SeaCMS Front-End Login Page

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. A logic flaw vulnerability exists in the front-end login page of SeaCMS. An attacker can exploit this vulnerability to gain access to other users...

[SECURITY] Fedora 33 Update: php-oojs-oojs-ui-0.39.3-1.fc33

OOjs UI Object-Oriented JavaScript =EF=BF=BD=EF=BF=BD=EF=BF=BD User Interf ace is a library that allows developers to rapidly create front-end web applications that operate consistently across a multitude of browsers...

Design/Logic Flaw

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...

SQL injection vulnerability in the front-end ad***_mo***_se***.php page of Shield Spirit Commodity Promotion System

Shield Spirit commodity promotion system can be applied to multiple types of public number, personal or business subscription number and service number can be used, easy to docking all kinds of public number, through the WeChat public number of the relevant interfaces configured to come into effe...

SQL Injection Vulnerability in Shield Spirit Commodity Promotion System Frontend he***.php Page

Shield Spirit commodity promotion system can be applied to multiple types of public number, personal or business subscription number and service number can be used, easy to docking all kinds of public number, through the WeChat public number of the relevant interfaces configured to come into effe...

SQL injection vulnerability in Shield Spirit Commodity Promotion System front-end ad***_de***.php page

Shield Spirit commodity promotion system can be applied to multiple types of public number, personal or business subscription number and service number can be used, easy to docking all kinds of public number, through the WeChat public number of the relevant interfaces configured to come into effe...

SQL injection vulnerability in the front-end aj***_di***.php file of Dascommerce Multi-User Mall system

Da Shangchuang is a B2B2C multi-user mall system launched by Shanghai Shangchuang Network Technology, which can build a new retail e-commerce platform for enterprises, covering multiple terminals such as PC mall, app mall, APP mall, micro mall, etc., and meeting a variety of e-commerce modes such...

Akamai and Snyk Partnership Creates a Powerful Combination for In-Browser Script Protection

A web experience begins with the sum of the code you created. But it also includes all the code the user is put in contact with when loading your website. This means the attack surface to monitor for web application software threats is not just your code repositories, but the sum of the assets re...

CVE-2020-25768

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

CVE-2020-25768

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

Input validation

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

CVE-2020-25768

CVE-2020-25768 (Contao) involves improper input validation that allows insertion of insert tags in front-end forms, which are later rendered as part of the page. Affected products/versions include Contao prior to 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1. The underlying issue is inject...

CVE-2020-25760

Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database...

Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

Insert tag injection in forms

Date : 2020-09-24 CVE ID : CVE-2020-25768 Description It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.51 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4.8 Contao...