13446 matches found
CVE-2022-23375: Unrestricted Upload of File with Dangerous Type
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...
Cross-site Scripting (XSS) - Generic
Description The user-controlled GET user parameter in index.php is unsanitized resulting in Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/user File: /web/edit/user/index.phpL11 // Check user argument if empty$GET'user' header"Location: /list/user/"; exit; Request...
Cross-site Scripting (XSS) - Reflected
Description The user-controlled GET domain parameter in index.php is unsanitized resulting in Reflected Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/web/ // File: /web/edit/web/index.phpL28 // List domain $vdomain = $GET'domain'; // User controllable parameter if...
GHSA-75JP-87W2-C6X2 ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
CVE-2021-44892
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
CVE-2021-44892
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
Remote code execution
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
CVE-2021-44892
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
PT-2022-12253
Name of the Vulnerable Software and Affected Versions ThinkPHP versions 3.x.x Description A Remote Code Execution RCE issue exists via the value filename in index.php, allowing a malicious user to obtain server control privileges. Recommendations For ThinkPHP versions 3.x.x, update to a version...
CVE-2021-44892: Undefined Security Weakness
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
CVE-2021-45286
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1 index.php, 2 bottom.php, and 3 topindex.php...
PT-2022-12319
Name of the Vulnerable Software and Affected Versions ZZCMS version 2021 Description A Directory Traversal issue exists via the skin parameter in several PHP files, including "index.php", "bottom.php", and "top index.php". This allows for potential unauthorized access to sensitive files...
CVE-2021-46360
Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...
CVE-2021-45286: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1 index.php, 2 bottom.php, and 3 topindex.php...
CVE-2021-46360: Unrestricted Upload of File with Dangerous Type
Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...
PT-2022-10310
Name of the Vulnerable Software and Affected Versions Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi version 1.0 Description A Cross Site Scripting XSS issue exists via the Category parameter in an add function in "category/index.php". Recommendations For Sourcecodester Gadget...
CVE-2021-34073: Improper Neutralization of Input During Web Page Generation
A Cross Site Scripting XSS vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php...