WordPress Frontend File Manager plugin <= 17.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 17.1. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.0...

Frontend File Manager < 18.3 - Unauthenticated Arbitrary Post Deletion

The wpfmdeletefile AJAX action of the plugin, available to unauthenticated users, was lacking CSRF and capability check, allowing unauthenticated users to delete arbitrary posts and pages from the blog...

WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated Content Injection and Stored XSS vulnerabilities

Unauthenticated Content Injection and Stored XSS vulnerabilities discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...

Frontend File Manager < 18.3 - Authenticated Arbitrary Settings Change to Arbitrary File Upload

The wpfmsavesettings AJAX action of the plugin, available to any authenticated user, was lacking CSRF and capability check, allowing any authenticated user to change the settings, and add PHP to the allowed filetype to be uploaded, which would then allow them to upload a malicious PHP file via th...

WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated Post Meta Change and Arbitrary File Download vulnerability

Unauthenticated Post Meta Change and Arbitrary File Download vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...

Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...

Command execution vulnerability in PbootCMS frontend Pa***.php file

PbootCMS is an open source free PHP enterprise web development and construction management system. PbootCMS front Pa.php file has a command execution vulnerability. An attacker can exploit the vulnerability to execute arbitrary code...

XSS vulnerability in WeiPHP 5.0 beta frontend Ga***.php at Shenzhen Yuanmeng Cloud Technology Co.

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. An XSS vulnerability exists in the frontend Ga.php of WeiPHP 5.0 beta version by Shenzhen Yuanmeng Yun Technology Co. Attackers can use this vulnerability to insert...

SQL Injection Vulnerability in kkcms frontend re***.php file

kkcms is an open source video capture and playback system . The system is mainly used to automatically capture film and television resources and provide online playback capabilities. kkcms front re.php file SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive...

SQL Injection Vulnerability in kkcms frontend re***.php file

kkcms is an open source video capture and playback system . The system is mainly used to automatically capture film and television resources and provide online playback capabilities. kkcms front re.php file SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive...

Logic flaw vulnerability in ejucms frontend Us***.php file

EJU real estate system ejucms is a set of localized O2O real estate website platform system. There is a logic flaw vulnerability in the ejucms front-end Us.php file. Attackers can use the vulnerability to modify any user information...

TuziCMS 2.0.6 SQL injection vulnerability in frontend ho*** us***.cl***.php

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS 2.0.6 front-end ho us.cl.php suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Far Autumn Medical Training Enrollment System v1.0 File Upload Vulnerability in Frontend

Far Autumn Medical Online Examination System adopts the universal test bank management software, applicable to all levels and types of medical schools and hospitals, the content contains the three basic exams for medical and nursing personnel, title exams, licensing exams, academic exams, trainin...

SQL injection vulnerability in the frontend p***_r***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System

EcoTimes Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

SQL injection vulnerability in the front-end mo***_pa***_mo***.asp file of the Environmental Protection Era Enterprise Online Bookkeeping Management System.

EcoTime Enterprise Online Bookkeeping Management System" is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and accounts payable, as well as company's bookkeeping and other related financial...

SQL injection vulnerability in the frontend mo***_sh***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System

EcoTime Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

SQL Injection Vulnerability in the Front-end us***.asp File of Environmental Times Enterprise Online Bookkeeping Management System

Eco Times Enterprise Online Bookkeeping Management System is a financial online bookkeeping software. SQL injection vulnerability exists in the us.asp file in the frontend of the EcoTimes Enterprise Online Bookkeeping Management System. An attacker can use the vulnerability to obtain sensitive...

SQL injection vulnerability in the front-end zh***_mo***.asp file of the online bookkeeping management system of Environmental Times Enterprises (CNVD-2019-06672)

Eco Times Business Online Bookkeeping Management System is a financial online bookkeeping software. There is a SQL injection vulnerability in the zhmo.asp file in the frontend of the EcoTimes Enterprise Online Bookkeeping Management System. An attacker can exploit the vulnerability to obtain...

SQL injection vulnerability in the front-end zh***_mo***.asp file of the online bookkeeping management system of Environmental Times Enterprises (CNVD-2019-06673)

Eco Times Enterprise Online Bookkeeping Management System is a financial online bookkeeping software. There is a SQL injection vulnerability in the zhmo.asp file in the frontend of the EcoTimes Enterprise Online Bookkeeping Management System. An attacker can exploit the vulnerability to obtain...

Shop7z Online Shopping System Fashion Edition Frontend Sh***_fo***.asp File SQL Injection Vulnerability

Shop7z online shopping system is to support Alipay, WeChat payment and a variety of commonly used interfaces, computer and cell phone version and APP seamless combination of data as a whole. Shop7z online shopping system fashion version of the front Shfo.asp file SQL injection vulnerability...