13497 matches found
CVE-2015-9479: Unrestricted Upload of File with Dangerous Type
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...
CVE-2019-17105
Centreon Web prior to 2.8.27 is affected by CVE-2019-17105 where the token generator in index.php is predictable. The issue is documented as a predictable token generator, enabling potential token guessing that could enable unauthorized access or session-related abuse. Connected sources also desc...
CVE-2019-17105
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
CVE-2019-17105
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
PT-2019-14945
Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue concerns a predictable token generator in the index.php file. This predictability could potentially be exploited. Recommendations For versions prior to 2.8.27, update to version 2.8.2...
CVE-2019-17105: Use of Insufficiently Random Values
The token generator in index.php in Centreon Web before 2.8.27 is predictable...
Remote code execution
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...
CVE-2019-17046
CVE-2019-17046 affects Ilch 2.1.22. The vulnerability arises because PHP is listed under “Allowed files” on the index.php/admin/media/settings/index page, enabling remote code execution. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, osv.dev, CVE listings) as a remote code exe...
CVE-2019-17046: Unrestricted Upload of File with Dangerous Type
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...
PT-2019-7403
Name of the Vulnerable Software and Affected Versions altos-connect plugin version 1.3.0 Description The issue concerns a cross-site scripting XSS problem. It affects the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php "PATH SELF" in the altos-connect plugin...
CVE-2015-9444: Improper Neutralization of Input During Web Page Generation
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATHSELF...
CVE-2019-16867
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
CVE-2019-16867
HongCMS 3.0.0 is affected by a path-traversal vulnerability allowing arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete (and similar CVE-2018-16774 path). Root cause is insufficient validation of the file path, enabling deletion of critical file...
CVE-2019-16867
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
PT-2019-14838
Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion by utilizing a ../ in the file parameter to the "admin/index.php/database/ajax" endpoint with the action set to delete. This can be exploited to delete critical fil...
CVE-2019-16867: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...
PT-2019-14793
Name of the Vulnerable Software and Affected Versions NoneCMS version 1.3 Description The issue concerns a CSRF flaw in the public/index.php/admin/admin/dele.html endpoint, which can be exploited to delete the admin user. Recommendations For NoneCMS version 1.3, as a temporary workaround, conside...
PT-2019-14791
Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description The issue allows for a CSRF attack with resultant XSS via the index.php endpoint, specifically when accessing the g=admin&m=index&a=index parameters. This can lead to unauthorized actions being performed on the...