WordPress 信息泄露漏洞

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A local file disclosure vulnerability exists in Patreon WordPress versions prior to 1.7.0. An attacker can exploit the vulnerability to obtain internal files such as database...

WordPress Patreon WordPress plugin <= 1.6.9 - Local File Disclosure vulnerability

Local File Disclosure vulnerability discovered by Jetpack Scan team in WordPress Patreon WordPress plugin versions = 1.6.9. Solution Update the WordPress Patreon WordPress plugin to the latest available version at least 1.7.0...

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

The Jetpack Scan team identified a Local File Disclosure vulnerability in the plugin that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in t...

XML External Entity (XXE) Injection

Overview xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to XML External Entity XXE Injection. Does not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and...

Atlassian Fisheye and Crucible Information Disclosure Vulnerabilities

Atlassian Fisheye and Crucible are both products of Atlassian Australia.Atlassian Fisheye is a deep source code viewer.Crucible is a code review tool. A security vulnerability exists in Atlassian Fisheye and Atlassian Crucible, which can be exploited by an attacker to browse local files via an...

CVE-2021-23835

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docsfile HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter which retrieves the contents of the specified...

CVE-2021-23835

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docsfile HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter which retrieves the contents of the specified...

Arbitrary file deletion

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docsfile HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter which retrieves the contents of the specified...

CVE-2021-23835

CVE-2021-23835 affects flatCore prior to 2.0.0 build 139. The issue is a local file disclosure in the docs_file HTTP request body parameter of the acp interface, which accepts malicious user input and can reveal sensitive backend files (e.g., /etc/passwd, SQLite DBs, PHP source) when an attacker ...

CVE-2021-23835

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docsfile HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter which retrieves the contents of the specified...

flatCore Information Disclosure Vulnerability

flatCore is a lightweight content management system CMS based on PHP and SQLite. An information disclosure vulnerability exists in flatCore CMS prior to version 2.0.0 build 139, which stems from a local file disclosure vulnerability found in the program's docsfile acp interface's HTTP request bod...

flatCore 输入验证错误漏洞

flatCore is a lightweight content management system CMS based on PHP and SQLite. An information disclosure vulnerability exists in flatCore CMS prior to version 2.0.0 build 139, which stems from a local file disclosure vulnerability found in the program's docsfile acp interface's HTTP request bod...

flatCore CMS XSS / File Disclosure / SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: 2.0.0 Build 139 fixed version: Release 2.0.0 Build 139 CVE number: CVE-2021-23835, CVE-2021-23836,...

CVE-2020-23490

There is a local file disclosure vulnerability in AVideo

PMB 5.6 Local File Disclosure / Directory Traversal

Exploit Title: PMB 5.6 - 'chemin' Local File Disclosure Date: 2020-10-13 Google Dork: inurl:opaccss Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 Tested on: Ubuntu 18.04.1 The PMB G...

PMB 5.6 - 'chemin' Local File Disclosure

Exploit Title: PMB 5.6 - 'chemin' Local File Disclosure Date: 2020-10-13 Google Dork: inurl:opaccss Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 Tested on: Ubuntu 18.04.1 The PMB G...

Wwbn Avideo Information Disclosure Vulnerability

Wwbn Avideo is a video platform builder written in PHP by the Wwbn team. A security vulnerability exists in AVideo versions prior to 8.9, which stems from the presence of a local file disclosure vulnerability. An attacker could use this vulnerability to read arbitrary files on the server. This...

Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446

Affected versions of Atlassian Dev Tools allow remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in WEB-INF in Fisheye/Crucible. The affected versions are before version 4.8.5. Affected versions: version 4.8.5 Fixed versions: 4.8.5 4.9.0...

Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446

Affected versions of Atlassian Dev Tools allow remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in WEB-INF in Fisheye/Crucible. The affected versions are before version 4.8.5. Affected versions: version 4.8.5 Fixed versions: 4.8.5 4.9.0...

Code injection

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php part of the installation process allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled...