MicroEngine Mailform 路径遍历漏洞

MicroEngine Mailform is a PHP mail form from MicroEngine Japan. A security vulnerability exists in MicroEngine Mailform versions 1.1.0 through 1.1.8, which stems from a path traversal vulnerability that could allow a remote attacker to save an arbitrary file on the server and execute it...

PT-2023-21179 · Unknown · Microengine Mailform

Name of the Vulnerable Software and Affected Versions: MicroEngine Mailform versions 1.1.0 through 1.1.8 Description: The issue allows a remote attacker to save an arbitrary file on the server and execute it, given that the file upload function and server save option are enabled. This is due to a...

MicroEngine Mailform 代码问题漏洞

MicroEngine Mailform is a PHP mail form from MicroEngine Japan. A security vulnerability exists in MicroEngine Mailform versions 1.1.0 through 1.1.8, which stems from an unrestricted upload of a dangerous type of file, and allows a remote attacker to save an arbitrary file on the server and execu...

Multiple vulnerabilities in MicroEngine Mailform

Overview MicroEngine Mailform provided by MicroEngine Inc. contains multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 - CVE-2023-27397 Path traversal CWE-22 - CVE-2023-27507 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and hibiki moriyama of...

JVN#31701509: Multiple vulnerabilities in MicroEngine Mailform

MicroEngine Mailform provided by MicroEngine Inc. contains multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 - CVE-2023-27397 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N| Base Score: 3.7 CVSS v2|...

PT-2023-5393 · Tracker Software Products · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: The issue is related to a use-after-free flaw in the mailForm method of PDF-XChange Editor, which can be exploited to execute arbitrary code on affected installations. This...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

Input validation

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

CVE-2022-38400

CVE-2022-38400 affects Mailform Pro CGI 4.3.1 and earlier. The root cause is the Thanks module saving user input data for a short window (default 30 seconds), enabling a remote unauthenticated attacker to access a specially crafted URL and disclose user input data. Impact is information disclosur...

PT-2022-24408 · Unknown · Mailform Pro Cgi

Name of the Vulnerable Software and Affected Versions: Mailform Pro CGI versions 4.3.1 and earlier Description: The issue allows a remote unauthenticated attacker to obtain user input data by accessing a specially crafted URL. Recommendations: For Mailform Pro CGI versions 4.3.1 and earlier, at t...

CVE-2022-38400: Exposure of Sensitive Information to an Unauthorized Actor

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Overview Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability CWE-200. Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulerability, it is...

SYNCK GRAPHICA Mailform Pro CGI 信息泄露漏洞

SYNCK GRAPHICA Mailform Pro CGI is a mail form from SYNCK GRAPHICA Japan. It can be used as a multiple transmission, questionnaire form, and application form. A security vulnerability exists in SYNCK GRAPHICA Mailform Pro CGI prior to version 4.3.1, which stems from the Thanks module saving user...

JVN#34205166: SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability CWE-200. Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulnerability, it is require...

CVE-2022-22142

Reflected cross-site scripting vulnerability in the checkbox of phpmailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors...

Multiple cross-site scripting vulnerabilities in php_mailform

Overview phpmailform provided by econosys system contains multiple cross-site scripting vulnerabilities listed below. Reflected cross-site scripting vulnerability regarding the checkbox CWE-79 - CVE-2022-22142 Reflected cross-site scripting vulnerability regarding the attached file name CWE-79 -...

Econosys System Php_Mailform 跨站脚本漏洞

Econosys System PhpMailform is a customizable open source Php mail form from Econosys System, Japan. A cross-site scripting vulnerability exists in econosys system phpmailform, which stems from insufficient cleanup of user-supplied data in attached filenames. A remote attacker could trick a victi...