34 matches found
CVE-2026-104110
Unauthenticated information disclosure in FileRise Pro portal endpoint get.php Summary public/api/pro/portals/get.php returns the full internal record of a FileRise Pro client portal — including its internal storage folder path, the client's contact email, and its complete upload policy — to any...
PT-2026-104431
FileRise Pro client portal leaks the folder path, the client email, and the upload policy. No session!! CVE-2026-104110: Sink is /api/pro/portals/get.php. Portal slug is enough. Internal path plus who the portal belongs to comes back in the response. https://t.co/4YkJ7s9dqf Cybersecurity AI...
Exploit for CVE-2026-104110
Unauthenticated information disclosure in FileRise Pro portal en...
PT-2026-93761
Name of the Vulnerable Software and Affected Versions Blog2Social plugin for WordPress versions prior to 9.1.0 Description Low-privileged users can enumerate WordPress user accounts. The b2s get select mandant user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs provided in the...
EUVD-2005-3308
Malware in sbrugna...
CVE-2024-29320
Wallos versions prior to 1.15.3 are vulnerable to an SQL Injection vulnerability. The flaw originates from the improper neutralization of special elements in the category and payment parameters within the /subscriptions/get.php API endpoint. This could allow an attacker to execute unauthorized SQ...
CVE-2024-29320
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...
CVE-2024-29320: Improper Neutralization of Special Elements used in an SQL Command
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php...
CVE-2024-0734
A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the...
Sql injection
A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the...
CVE-2024-0734 Smsot get.php sql injection
A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the...
PT-2024-15791 · Smsot · Smsot
Name of the Vulnerable Software and Affected Versions: Smsot versions up to 2.12 Description: A critical issue has been found in Smsot, affecting an unknown functionality of the file /get.php. The manipulation of the tid argument leads to sql injection. This issue can be exploited remotely...
Smsot SQL Injection Vulnerability
Smsot is a professional community operation solution from China Motech Smsot company. A SQL injection vulnerability exists in Smsot 2.12 and earlier versions, which stems from the parameter tid in the file /get.php that causes SQL injection...
CVE-2024-0734: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the...
CVE-2020-28977: Server-Side Request Forgery (SSRF)
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF...
PT-2020-17075
Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows an unauthenticated attacker to make a request to any internal and external server via the /includes/lib/get.php endpoint with the subdomain variable set to SSRF. This enable...
PT-2019-4309
Name of the Vulnerable Software and Affected Versions D-Link DIR-412 version A1-1.14WW Description The issue concerns a lack of authentication requirements for certain web interfaces on the affected router. This allows an attacker to access the router's log file through the "log get.php" API...
PT-2017-5797
Name of the Vulnerable Software and Affected Versions: Eyou Mail System versions prior to 3.6 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to the "/admin/domain/ip login set/d ip login get.php" API endpoint. This is...
