WUZHI CMS 路径遍历漏洞

WUZHI CMS is a high-performance open source content management system , support for LNAMP architecture , suitable for portals , corporate website building , cell phone sites , microblogging promotion. WUZHI CMS 4.1.0 coreframe/app/template/admin/index.php directory traversal vulnerability exists...

FUDForum 跨站脚本漏洞

FUDforum is an open source forum system built on PHP+MySQL/PostgreSQL. A cross-site scripting vulnerability exists in FUDForum 3.1.0. An attacker can exploit this vulnerability to inject JavaScript via the srch parameter in index.php...

FUDForum 跨站脚本漏洞

FUDforum is an open source forum system built on PHP+MySQL/PostgreSQL. A cross-site scripting vulnerability exists in FUDForum 3.1.0. An attacker can exploit this vulnerability to inject JavaScript via the author parameter in index.php...

geojsonkml Command Injection Vulnerability

geojsonkml is an open source node.js module for converting geojson to kml. A command injection vulnerability exists in geojson2kml, which stems from vulnerability to command injection attacks via the index.js file...

Sourcecodester Seat-Reservation-System SQL注入漏洞

Seat-Reservation-System is a seat reservation system. A sql injection vulnerability exists in Seat-Reservation-System 1.0. The vulnerability is caused due to the id and file parameters in the index.php file not being input/output filtered for special characters. An attacker can exploit this...

GHSA-487W-PQCM-63HQ Command injection in buns

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

CVE-2020-7794

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

CVE-2020-7794

CVE-2020-7794 affects all versions of the buns package. The injection point is in lib/index.js:678 inside the exported function install(requestedModule). This enables command injection via crafted input; PoC and advisory details indicate insecure use of exec leading to arbitrary code execution. T...

Terramaster TOS 跨站脚本漏洞

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A cross-site scripting vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the mod...

Advanced Comment System Path Traversal Vulnerability

Advanced Comment System is an advanced comment system. ACS Advanced Comment System 1.0 suffers from a path traversal vulnerability that originates in index.php, an advanced component system...

Skoranga Node-connection-tester Command Injection Vulnerability

Skoranga Node-connection-tester is a Javascript-based software from the individual developers at Skoranga for testing whether a connection can be established to a remote host and port. A command injection vulnerability exists in connection-tester versions prior to 0.2.1, which originates in...

EGavilan Barcodes generator 跨站脚本漏洞

Egavilan Media Barcodes generator is a Php-based barcode generator for product names from Egavilan Media. EGavilan Barcodes generator 1.0 suffers from a cross-site scripting vulnerability that originates from cross-site scripting XSS via index.php. An attacker can exploit this vulnerability to...

PT-2020-17111 · Unknown · Car Rental Management System

Name of the Vulnerable Software and Affected Versions: Car Rental Management System version 1.0 Description: An issue was discovered in the Car Rental Management System where an unauthenticated user can perform a file inclusion attack against the "/index.php" file with a partial filename in the...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: /var a = require"nuance-gulp-build-common" a.run"touch JHU" Credit: JHU System Security Lab...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule. PoC var root = require"buns"; var name = "& touch JHU"; root.installname; Remediation There is no...

SourceCodester Gym Management System 跨站脚本漏洞

SourceCodester Gym Management System is the American SourceCodester company's a gym management system. The system by C and sql server for the development of technology, with customer and supplier management, product management, sales management, gym membership management, fitness assessment, syst...

CVE-2020-12840

ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php...

Authorization Bypass

github.com/helm/helm is vulnerable to authorization bypass. An attacker with write access to a repository index file is able to inject a malicious chart into a repository...

CVE-2020-15185

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker...

Design/Logic Flaw

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker...