CVE-2021-46115

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...

Remote code execution

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.TemplateControllerdoInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code...

Code injection

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...

Remote code execution

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46115

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...

CVE-2021-46115

The CVE-2021-46115 entry concerns jpress 4.2.0, where a vulnerability in the io.jpress.web.admin._TemplateController#doUploadFile function in the admin panel allows uploading templates to inject malicious code, enabling remote code execution. Multiple connected sources corroborate that this RCE s...

CVE-2021-46116

CVE-2021-46116 affects jpress 4.2.0 and enables remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel function to install templates allows attackers to inject and execute malicious code; underlying issue is improper filtering during construction of code segm...

CVE-2021-46116

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.TemplateControllerdoInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code...

CVE-2021-46117

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46117

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

Remote code execution

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46117

CVE-2021-46117 affects jpress 4.2.0 and enables remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The issue arises because the admin panel allows editing email templates, enabling attackers to inject malicious code. Publicly disclosed details in the provided documents con...

CVE-2021-46117

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

WordPress Cookie Notification Plugin Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A SQL injection vulnerability exists in previous versions of the Wordpress Plugin Cookie Notification Plugin 1.0.9, which stems from the product's failure to validate special characters in the id...

Insecure Session Management

pterodactyl/panel is vulnerable to insecure session management. The vulnerability exists in handle function in the AuthenticateKey.phpfile, allowing malicious attackers to compromises the API key generation and log in to the system...

Online Project Time Management System 1.0 - Multiple Stored Cross Site Scripting (XSS) (Authenticated)

Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Linux Servers at Risk of RCE Due to Critical CWP Bugs

Researchers have discovered two critical bugs in Control Web Panel CWP – a popular web hosting management software used by 200,000+ servers – that could allow for remote code execution RCE as root on vulnerable Linux servers. CWP, formerly known as CentOS Web Panel, is an open-source Linux contro...

WordPress plugin SQL注入漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A SQL injection vulnerability exists in previous versions of the Wordpress Plugin Cookie Notification Plugin 1.0.9, which stems from the product's failure to validate special characters in the id...

Critical Bugs in Control Web Panel Expose Linux Servers to RCE Attacks

Researchers have disclosed details of two critical security vulnerabilities in Control Web Panel that could be abused as part of an exploit chain to achieve pre-authenticated remote code execution on affected servers. Tracked as CVE-2021-45467, the issue concerns a case of a file inclusion...

PT-2022-3811

Name of the Vulnerable Software and Affected Versions CentOS Web Panel versions prior to 0.9.8.1107 Description The issue is related to incorrect handling of code generation in CentOS Web Panel, allowing a remote attacker to execute arbitrary code using a specially crafted request. An...