Cacti 1.2.22 unauthenticated command injection

This module exploits an unauthenticated command injection vulnerability in Cacti through 1.2.22 CVE-2022-46169 in order to achieve unauthenticated remote code execution as the www-data user. The module first attempts to obtain the Cacti version to see if the target is affected. If LOCALDATAID...

PT-2022-27606 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A buffer overflow issue was discovered via the list parameter in the formwrlSSIDget function. This issue can be exploited, potentially leading to unintended consequences. Recommendations: For Tenda i...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

Design/Logic Flaw

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4257 C-DATA Web Management System GET Parameter jumpto.php argument injection

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-3383

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the getoptionvaluefromcallback function that accepts user supplied input and passes it through calluserfunc. This makes it possible for authenticated attackers, with...

get-invest.eu Cross Site Scripting vulnerability OBB-3072522

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-27677

Name of the Vulnerable Software and Affected Versions PaddlePaddle versions prior to 2.4 Description The issue arises from the paddle.audio.functional.get window function calling eval on a user-supplied winstr, leading to potential code injection and arbitrary code execution. Recommendations For...

PaddlePaddle 代码注入漏洞

PaddlePaddle Flying Paddle is an independent R&D deep learning platform open-sourced by China's Flying Paddle PaddlePaddle. PaddlePaddle 2.4 has a security vulnerability , the vulnerability stems from its paddle.audio.functional.getwindow component in the user-supplied winstr call eval allows an...

Security feature bypass

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

PT-2022-25826 · Unknown · Qmpass/Leadshop

Name of the Vulnerable Software and Affected Versions: qmpass/leadshop version 1.4.15 Description: The issue allows an attacker to control the target host by calling any function in leadshop.php via the GET method, potentially leading to remote code execution RCE. This can enable an attacker to...

PT-2022-10458 · Unknown · Rizalafani Cms-Php

Name of the Vulnerable Software and Affected Versions: rizalafani cms-php version 1 Description: The issue is related to a SQL Injection vulnerability in the get user function located in login manager.php. This vulnerability allows for potential SQL injection attacks. Recommendations: For...

CVE-2022-43215

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php...

PT-2022-27308 · Unknown · Appalti & Contratti

Name of the Vulnerable Software and Affected Versions: Appalti & Contratti version 9.12.2 Description: An issue was discovered in the target web applications, which are subject to multiple SQL Injection vulnerabilities. Some of these vulnerabilities are executable even by unauthenticated users, a...

CVE-2022-39178

Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure...

CVE-2022-36787

webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE...

CVE-2022-39178 Webvendome - webvendome Internal Server IP Disclosure

Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure...

CVE-2022-39178 Webvendome - webvendome Internal Server IP Disclosure

Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure...

PT-2022-24792 · Unknown · Webvendome

Name of the Vulnerable Software and Affected Versions: Webvendome affected versions not specified Description: The issue concerns an internal server IP disclosure in Webvendome. It can be triggered by sending a GET request to a specific endpoint, although the exact endpoint is not specified in th...