PT-2020-10490

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows reflected XSS via the PATH INFO to the address/ URI. This can be exploited by manipulating the PATH INFO variable in the request. Recommendations For ERPNext version 11.1.47, consider...

PT-2020-10493

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the contact/ URI. This can potentially lead to malicious script execution on the client-side. Recommendations For ERPNext version 11.1.47, as a tempora...

PT-2020-10497

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "api/" URI. This means an attacker can craft a malicious URL that, when visited by a user, can execute arbitrary JavaScript code in the context of...

PT-2020-10494

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "project/" URI. This means an attacker can inject malicious code into the PATH INFO variable, potentially leading to the execution of unauthorized...

PT-2020-10492

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "blog/" URI. This means an attacker can inject malicious code into the PATH INFO variable, potentially leading to the execution of unauthorized...

Exploit for Out-of-bounds Write in Php

This is an exploit module for a bug in php-fpm CVE-2019-11043. The bug allows a web user to execute code on a vulnerable server if the server has a specific configuration. The exploit targets the php-fpm service running on a server with a configuration that includes a "location" block with a...

CVE-2014-1634

SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/ancategoryid/ PATHINFO...

PT-2020-7148

Name of the Vulnerable Software and Affected Versions Ariadne version 2.7.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO parameter to API endpoints such as "index.php" and "loader.php". Recommendations For Ariadne version 2.7.6, consider...

PT-2020-10455

Name of the Vulnerable Software and Affected Versions Jobberbase version 2.0 Description The issue is related to SQL injection via the PATH INFO to the "jobs-in" endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices...

php: underflow in env_path_info in fpm_main.c

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution...

PT-2019-7004

Name of the Vulnerable Software and Affected Versions Monitorix versions prior to 3.4.0 Description A cross-site scripting XSS issue exists in the handle request function in lib/HTTPServer.pm, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO. Recommendations For...

CVE-2011-4455

Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-adminsystem.php, 2 tiki-pagehistory.php, 3 tiki-removepage.php, or 4 tiki-renamepage.php...

CVE-2011-4454

Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-remindpassword.php, 2 tiki-index.php, 3 tiki-loginscr.php, or 4 tiki-index...

Cross site scripting

Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-adminsystem.php, 2 tiki-pagehistory.php, 3 tiki-removepage.php, or 4 tiki-renamepage.php...

CVE-2011-4455

Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-adminsystem.php, 2 tiki-pagehistory.php, 3 tiki-removepage.php, or 4 tiki-renamepage.php...

PT-2019-6693

Name of the Vulnerable Software and Affected Versions Tiki versions 8.0 RC1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the path info to several PHP files, including 1 "tiki-remind password.php", 2 "tiki-index.php", 3 "tiki-login scr.php", ...

PT-2019-6694

Name of the Vulnerable Software and Affected Versions Tiki versions 7.2 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the path info to several PHP files, including "tiki-admin system.php", "tiki-pagehistory.php", "tiki-removepage.php", and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2012-5193

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

php: underflow in env_path_info in fpm_main.c

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution...