PT-2019-18592

Name of the Vulnerable Software and Affected Versions SAMSUNG X7400GX SyncThru Web Service version V6.A6.25 V11.01.05.25 08-21-2015 Description A security issue exists in the SyncThru Web Service, where an XSS issue is present in the "/sws/swsAlert.sws" endpoint, affecting multiple parameters:...

CVE-2019-7402

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

PT-2019-6391

Name of the Vulnerable Software and Affected Versions uriparser versions prior to 0.9.1 Description The issue is related to an out-of-bounds read in the URI FUNC function within the UriParse.c component of the uriparser. This occurs when parsing an incomplete URI that contains an IPv6 address wit...

ThinkPHP 5.x Remote Code Execution

Exploit Title: ThinkPHP 5.x v5.0.23,v5.1.31 Remote Code Execution Date: 2018-12-11 Exploit Author: VulnSpy Vendor Homepage: https://thinkphp.cn Software Link: https://github.com/top-think/framework/ Version: v5.x below v5.0.23,v5.1.31 CVE: N/A Exploit...

PT-2018-12462

Name of the Vulnerable Software and Affected Versions GNU Libextractor versions prior to 1.7 Description The issue is related to a stack-based buffer overflow in the ec read file func function, located in unzip.c. Recommendations For GNU Libextractor versions prior to 1.7, update to version 1.7 o...

PT-2018-5072

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue allows a remote unauthenticated user to bypass authentication and access the administrator panel. This can be achieved by navigating directly to the...

CVE-2016-9482: Authentication Bypass by Assumed-Immutable Data

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

PT-2018-16060

Name of the Vulnerable Software and Affected Versions Qualcomm Android for MSM versions prior to security patch level 2018-04-05 Firefox OS for MSM versions prior to security patch level 2018-04-05 QRD Android versions prior to security patch level 2018-04-05 Description The issue is related to a...

Webzyme Couch Path Disclosure Vulnerability

Webzyme Couch is the United States Webzyme Softwares, Inc. of a set of open source content management system CMS. A security vulnerability exists in Webzyme Couch. A remote attacker can exploit the vulnerability by sending a direct request to the includes/mysql2i/mysql2i.func.php or...

PT-2016-5821

Name of the Vulnerable Software and Affected Versions Quagga affected versions not specified Description The issue is related to the bgp dump routes func function in bgpd/bgp dump.c, which does not perform size checks when dumping data. This might allow remote attackers to cause a denial of...

Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=591 There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this method can free the MovieClip, which is then used. A minimal...

GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2015-04183)

GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in the admin/filebrowser.php script in GetSimple CMS versio...

CVE-2015-5356

Cross-site scripting XSS vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter...

CVE-2015-5356

Cross-site scripting XSS vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter...

CVE-2015-5356

Cross-site scripting XSS vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter...

PT-2015-6863

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 3.3.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the func parameter in the admin/filebrowser.php file. Recommendations For versions prior to...

CVE-2015-5356: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter...

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

知道key的情况下对ucserver进行注射

简要描述： 因为帮finger解决问题，无意中看到的漏洞。 怎么拿到key要问finger。 详细说明： 在/ucserver/control/feed.php内有一段代码： function onadd $this-load'misc'; $appid = intval$this-input'appid'; $icon = $this-input'icon'; $uid = intval$this-input'uid'; $username = $this-input'username'; $bodydata =...

PT-2014-5005

Name of the Vulnerable Software and Affected Versions EGroupware Enterprise Line EPL versions prior to 1.1.20140505 EGroupware Community Edition versions prior to 1.8.007.20140506 EGroupware versions prior to 14.1 beta Description The issue allows remote authenticated administrators to execute...