240 matches found
CVE-2022-48008
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-48008: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file...
PT-2023-15546
Name of the Vulnerable Software and Affected Versions LimeSurvey version 5.4.15 Description An arbitrary file upload vulnerability in the plugin manager of LimeSurvey allows attackers to execute arbitrary code via a crafted PHP file. Recommendations For LimeSurvey version 5.4.15, consider disabli...
Cross-site Scripting (XSS)
facturascripts/facturascripts is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the ini parameter in the getPluginInfo function of PluginManager.php, allowing an attacker to inject and execute malicious javascript...
CVE-2022-27165
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcmsadminPluginmanagersetstatus...
PT-2022-18261
Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.2.2 Description The issue is related to SQL Injection, which can be exploited via the cszcms admin Plugin manager setstatus function. This allows for potential unauthorized access to database information. Recommendations For...
CVE-2021-0706
In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
CVE-2021-0706
In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
Remote Code Execution
shopware/platform is vulnerable to remote code execution.The plugin manager allows an authenticated attacker to perform remote code execution without ACL permissions...
GHSA-PJJ4-JJGC-H3R8 Authenticated remote code execution
Impact Authenticated remote code execution using plugin manager without ACL permissions. Patches We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview...
Authenticated remote code execution
Impact Authenticated remote code execution using plugin manager without ACL permissions. Patches We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview...
PT-2021-24445
Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.3.5.2 Description: The issue allows for authenticated remote code execution using the plugin manager without ACL permissions. Recommendations: For versions prior to 6.3.5.2, update to version 6.3.5.2. For older...
CSZ CMS 1.2.9 Cross Site Scripting
Exploit Title: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting Date: 2020/12/28 Exploit Author: SunCSR Vendor Homepage: https://www.cszcms.com/ Software Link: https://github.com/cskaza/cszcms Version: 1.2.9 Tested on: CSZ CMS 1.2.9 1. Reflected XSS Go to url...
Unvalidated redirects in UPM via reverse tabnapping
Affected versions of Atlassian Jira Server and Data Center allow an authenticated attacker to redirect a user to a malicious website via an unvalidated redirect vulnerability in some Universal Plugin Manager pages, e.g. "Manage apps" and "Find new apps". Affected versions: version 7.13.16 7.14.0 ...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Limesurvey Plugin Manager Access Vulnerability
limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A plugin manager access vulnerability exists in Limesurvey versions prior to 3.17.14. An attacker can exploit this vulnerability to acces...
CVE-2019-16186
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
CVE-2019-16186
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions...
