13445 matches found
ThinkPHP 安全漏洞
ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP Framework v5.0.24, which stems from the lack of configuration of the PATHINFO parameter. An attacker can...
PT-2022-11556
Name of the Vulnerable Software and Affected Versions EyouCms version 1.5.4-UTF8-SP3 Description The issue arises from the wechat return function in /controller/Index.php, which passes user input directly into the simplexml load string function without prohibiting external entities. This triggers...
CVE-2021-42194: Improper Restriction of XML External Entity Reference
The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...
CVE-2021-45791
CVE-2021-45791 affects Slims8 Akasia 8.3.1. A SQL injection exists in multiple admin modules (bibliography, member_type, user_group, membership index) via the dir parameter, due to insufficient input escaping/validation. Exploitation is described as feasible by remotely authenticated librarian us...
CVE-2021-45786
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...
PT-2022-12406
Name of the Vulnerable Software and Affected Versions maccms version 10 Description The issue allows an attacker to gain privileges by logging in through the /index.php/user/login endpoint, specifically by exploiting the col and openid parameters. Recommendations For maccms version 10, consider...
CVE-2021-45786: Improper Authentication
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...
CVE-2022-25495
The component /jqueryfileupload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file...
CVE-2022-25495: Unrestricted Upload of File with Dangerous Type
The component /jqueryfileupload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file...
PT-2022-17331
Name of the Vulnerable Software and Affected Versions CuppaCMS version 1.0 Description The issue allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file. This is possible due to a flaw in the /jquery file upload/server/php/index.php component. Recommendations...
CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
UBUNTU-CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
Design/Logic Flaw
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
CVE-2021-46709
CVE-2021-46709 affects phpLiteAdmin up to version 1.9.8.2, where the index.php newRows parameter (also known as num or number) allows cross-site scripting (XSS). The issue stems from insufficient input validation/output handling for this parameter. Impact is XSS on affected installations; no expl...
CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
CVE-2021-46709
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter aka num or number...
PT-2022-12910 · Unknown +2 · Phpliteadmin +2
Name of the Vulnerable Software and Affected Versions: phpLiteAdmin versions prior to 1.9.8.2 Description: The issue allows for XSS attacks via the newRows parameter, also known as num or number, in the index.php file. Recommendations: For versions prior to 1.9.8.2, avoid using the newRows...