173 matches found
Cross-Site Request Forgery (CSRF) in erikdubbelboer/phpredisadmin
โ๏ธ Description The Import functionality in the application is vulnerable to CSRF attacks. ๐ต๏ธโโ๏ธ Proof of Concept history.pushState'', '', '/' ๐ฅ Impact This vulnerability can let an attacker import data to the database without the knowledge/interaction of the user...
WordPress Plugin RSVPMaker ไปฃ็ ้ฎ้ขๆผๆด
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...
CVE-2021-1888: Double Free
Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables...
CVE-2021-25838
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting XSS payload in file-upload...
CVE-2021-25838
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting XSS payload in file-upload...
CVE-2021-25838
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting XSS payload in file-upload...
CVE-2021-25838
MintHCM Release 3.0.8 contains an XSS vulnerability in the Import feature during file-upload. The issue arises from the Import functionality allowing an attacker to inject and execute JavaScript in uploaded content, enabling cross-site scripting. Impact is limited to XSS as described in multiple ...
CVE-2021-25838: Improper Neutralization of Input During Web Page Generation
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting XSS payload in file-upload...
PT-2021-16813
Name of the Vulnerable Software and Affected Versions MintHCM version 3.0.8 Description The issue concerns the Import function, which allows an attacker to execute a cross-site scripting XSS payload through file-upload. This could potentially lead to malicious script execution on the client-side...
OpenMRS Input Validation Error Vulnerability (CNVD-2020-26250)
OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from an input validation error vulnerability that stems from the import function of the data exchange module not properly redirecting to the login page. An attacker could exploit th...
WordPress ultimate-faqs plugin input validation error vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. ultimate-faqs is a FAQ plugin used in it. An input validation error vulnerability exists in the Functions/EWDUFAQImport.php file in...
CVE-2019-11677
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity XXE Injection...
PT-2019-12475
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer versions prior to 12.3 Build 123224 Description The issue concerns the Custom Report import function, which is susceptible to XML External Entity XXE Injection. This means that an attacker could potentially...
CVE-2019-5624: Improper Limitation of a Pathname to a Restricted Directory
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level...
Snapchat: Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata
Hey there, I was looking at your ads site with @daeken, we found some weird behavior in the import function of the creative app. Here are the steps: POC - Login to https://business.snapchat.com/ - Go to creative library - New Creative - Under "Topsnap Media", click on "Create" - Click on any of t...
OpenRefine XML External Entity Injection Vulnerability
OpenRefine is a standalone open source desktop application for data cleaning and converting data to other formats. An XML External Entity Injection XXE vulnerability exists in the data import function in OpenRefine versions 3.1 and earlier. The vulnerability can be exploited to read arbitrary fil...
CVE-2018-19404
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url=...
PHPOK Arbitrary File Upload Vulnerability
PHPOK is an enterprise building system that supports expansion. An arbitrary file upload vulnerability exists in the 'importf' function in the framework/admin/moduleccontrol.php file in PHPOK version 4.9.032. An attacker can exploit this vulnerability to upload arbitrary zip files...
Privilege escalation
PHPOK 4.9.032 has an arbitrary file upload vulnerability in the importf function in framework/admin/moduleccontrol.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944...
Denial of Service Vulnerability in INVT Studio
INVT Studio is a serial and Ethernet based inverter monitoring system. A denial of service vulnerability exists in INVT Studio version 1.20 due to a failure to follow the specification for code behavior at the INVT Studio import function. An attacker can exploit this vulnerability to cause a deni...