32 matches found
CVE-2020-12743
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...
EUVD-2020-5031
Malware in sbrugna...
EUVD-2012-1246
Malware in sbrugna...
EUVD-2020-14499
Malware in sbrugna...
CVE-2020-21731
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update.; An attacker can inject JavaScript code, and the webapplication stores the injected code...
Gazie Cross-Site Scripting Vulnerability
Gazie is a financial application based on PHP and MySQL. The program supports features such as invoice management, inventory management and order management. A cross-site scripting vulnerability exists in Gazie version 7.29, which originates from an improper validation of client-side data by...
CVE-2020-21731
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
CVE-2020-21731
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
Cross site scripting
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
CVE-2020-21731
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
CVE-2020-21731
Gazie 7.29 is affected by a stored Cross-Site Scripting (XSS) vulnerability. The issue occurs in the web app via the admin_utente.php?user_name=amministratore&Update parameter, where injected JavaScript code can be stored and later executed by users. This is a general XSS flaw described across mu...
PT-2020-15384
Name of the Vulnerable Software and Affected Versions Gazie version 7.29 Description The issue allows for Cross Site Scripting XSS via the "http://192.168.100.7/gazie/modules/config/admin utente.php" endpoint, specifically through the user name variable. An attacker can inject JavaScript code,...
CVE-2020-21731: Improper Neutralization of Input During Web Page Generation
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
Gazie File Inclusion Vulnerability
Gazie is a financial application based on PHP and MySQL. The program supports features such as invoice management, inventory management and order management. A security vulnerability exists in Gazie version 7.32. An attacker can exploit the vulnerability to include arbitrary PHP files with the he...
CVE-2020-12743
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...
CVE-2020-12743
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...
Authentication flaw
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...
CVE-2020-12743
Gazie 7.32 contains an unauthenticated PHP file inclusion vulnerability in /setup/install/setup.php, which remains accessible after setup and can be requested via a hidden_req POST parameter. The issue enables arbitrary PHP file inclusion and is described with high impact (NVD CVSSv3.1: CRITICAL,...
CVE-2020-12743
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...
CVE-2020-12743: Files or Directories Accessible to External Parties
An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...