CVE-2024-34470

HSC MailInspector - CVE-2024-34470 A critical vulnerability has been found in HSC Mailinspector up to version 5.2.18. This vulnerability affects an unknown functionality of the file /public/loader.php. Manipulating the 'path' argument with an unknown input leads to a path traversal vulnerability...

CVE-2024-34470

CVE-2024-34470 Description: An Unauthenticated user can abuse Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server...

wordpress_cve-2018-6389

wordpresscve-2018-6389 Intenta explotar una vulnerabilidad de WordPress CVE-2018-6389 que puede ser utilizada para causar una Denegación de Servicio. ADVERTENCIA: Este software no realiza un DoS en objetivos vulnerables; ejecuta solo una llamada HTTP GET para verificar si la vulnerabilidad está...

CVE-2026-58455: Execution After Redirect (EAR)

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit after an authentication redirect in loader.php combined with unsanitized input passed to shellexec in...

CVE-2026-48241

Open ISES Tickets before 3.44.2 stores MySQL credentials in loader.php as hardcoded values committed to the source tree. This allows any reader of the public source or an unauthenticated read on a deployed install to obtain username, password, and database name and potentially connect to the data...

CVE-2026-48241 Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php a public-facing database utility that are committed to the source repository. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed...

tickets 信任管理问题漏洞

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a vulnerability related to trust management. This vulnerability stemmed from hardcoding MySQL database credentials in the loader.php file and submittin...

CVE-2026-48241: Use of Hard-coded Credentials

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php a public-facing database utility that are committed to the source repository. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed...

EUVD-2022-29790

Malicious code in bioql PyPI...

CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

GHSA-X38C-V778-W56M ICEcoder Path Traversal vulnerability

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-41373

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-41373

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-41373

ICEcoder version 8.1 is susceptible to a Path Traversal vulnerability within the lib/backup-versions-preview-loader.php file. This flaw allows for improper limitation of a pathname to a restricted directory. As a remediation, it is recommended to restrict access to the affected file until a forma...

CVE-2024-41373

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-41373

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-41373: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...

CVE-2024-34470: Path Traversal: '\..\filename'

An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read...

Improper Access Control

moodle/moodle is vulnerable to Improper Access Control. The vulnerability exists in parsefileinformationfromurl function of lang.php and loader.php due to improper folder restrictions which allows an attacker to send a specially crafted HTTP request and create arbitrary folders on the system...

CVE-2021-45467: Missing Authorization

In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/accountnewcreate&acc=guadaapi URI. Any number of %00...