PT-2023-16629

Name of the Vulnerable Software and Affected Versions SourceCodester Best POS Management System version 1.0 Description A problematic issue has been found in the Image Handler component, affecting the function save settings of the file "index.php?page=site settings". The manipulation of the...

CVE-2019-12348

An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter...

Schools Alert Management Script Arbitrary File Deletion Vulnerability

PHP Scripts Mall Schools Alert Management Script is a school management system script by PHP Scripts Mall India. A security vulnerability exists in PHP Scripts Mall Schools Alert Management Script. The vulnerability can be exploited to delete arbitrary files using the 'img' parameter in the...

CVE-2018-12053

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

PT-2018-10974

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Deletion via the img parameter in the "delete img.php" endpoint by utilizing directory traversal. Recommendations...

CVE-2018-12053: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in deleteimg.php by using directory traversal...

CVE-2014-9734

The Slider Revolution (revslider) plugin for WordPress, in versions prior to 4.2 , contains a directory traversal vulnerability. The root cause is a failure to adequately filter the img parameter in the revslider_show_image action handled by the wp-admin/admin-ajax.php script. A remote attacker c...

CVE-2014-9734: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

CVE-2010-3601

SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter...

Sql injection

SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter...

CVE-2010-3601: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter...

CVE-2008-1799: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. dot dot in the img parameter...

CVE-2008-1119: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in include/doc/getimage.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the img parameter...

CVE-2007-3251: Undefined Security Weakness

Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to 1 include and execute arbitrary local files via a .. dot dot in the adminlang cookie to admin/functions.php or 2 read arbitrary local files via the img parameter to admin/showimg.php...

CVE-2007-2901: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors...

CVE-2006-6370: Undefined Security Weakness

SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php...

CVE-2006-5320: Undefined Security Weakness

Directory traversal vulnerability in getimg.php in Album Photo Sans Nom 1.6 allows remote attackers to read arbitrary files via the img parameter...

CVE-2006-2977: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in big.php in Mafia Moblog 0.6M1 and earlier allows remote attackers to execute arbitrary SQL commands via the img parameter...

CVE-2005-0857: Undefined Security Weakness

Cross-site scripting XSS vulnerability in avatar.php for CoolForum 0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the img parameter...