1533 matches found
CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF
The plugin lets user input reach a sensitive requireonce call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server. 1 Create a malicious PHP script $ echo ' shell.php 2 Add it to a fake .doc file, who will...
CVE-2022-31086
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the...
CVE-2022-31086: Improper Neutralization of Special Elements in Output Used by a Downstream Component
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the...
CVE-2022-1667
Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC e.g., from the browser console or by loading the corresponding, browser accessible PHP script...
CVE-2022-2102: Improper Enforcement of Behavioral Workflow
Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file...
CVE-2022-1667: Improper Enforcement of Behavioral Workflow
Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC e.g., from the browser console or by loading the corresponding, browser accessible PHP script...
PT-2022-3279
Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 8.0 Description The issue arises from incorrect regular expressions in LDAP Account Manager, allowing the upload of PHP scripts to the /config/templates/pdf/ directory. This could lead to Remote Code...
Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network
The Parrot traffic direction system TDS that came to light earlier this year has had a larger impact than previously thought, according to new research. Sucuri, which has been tracking the same campaign since February 2019 under the name "NDSW/NDSX," said that "the malware was one of the top...
CVE-2022-30352
phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...
CVE-2021-42643
cmseasy V7.7.520211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability...
CVE-2021-42643
cmseasy V7.7.520211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability...
Remote code execution
cmseasy V7.7.520211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability...
CVE-2021-42643: Improper Limitation of a Pathname to a Restricted Directory
cmseasy V7.7.520211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability...
PT-2022-3529
Name of the Vulnerable Software and Affected Versions Secheron SEPCOS Single Package relay control and protection software affected versions not specified Description The issue is related to the incorrect implementation of a sequence of actions in the software. It allows a remote attacker to rebo...
Car Portal Template Cross Site Scripting
Document Title: =============== Car Portal Template - Search Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2299 Release Date: ============= 2022-02-08 Vulnerability Laboratory ID VL-ID: ====================================...
Car Portal Template - (Search) Persistent Web Vulnerability
Document Title: =============== Car Portal Template - Search Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2299 Release Date: ============= 2022-02-08 Vulnerability Laboratory ID VL-ID: ====================================...
uBidAuction 2.0.1 Cross Site Scripting Vulnerability
Document Title: =============== uBidAuction v2.0.1 - Multiple XSS Web Vulnerabilities Product & Service Introduction: =============================== uBidAuction is a powerful, scalable & fully-featured classic and bid auction software that lets create the ultimate profitable online auctions...
Croogo 3.0.2 Shell Upload
Exploit Title: Croogo 3.0.2 - Unrestricted File Upload Date: 06/12/2021 Exploit Author: Enes Özeser Vendor Homepage: https://croogo.org/ Software Link: https://downloads.croogo.org/v3.0.2.zip Version: 3.0.2 Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3 == 'setting-43'...
Easy Cart Shopping Cart - (Search) Persistent Vulnerability
Document Title: =============== Easy Cart Shopping Cart - Search Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2298 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...