7896 matches found
Command injection
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request...
CVE-2022-25046
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2022-25046
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
Path traversal
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2022-25046
The CVE-2022-25046 entry describes a path traversal vulnerability in loader.php of CWP (CentOS Web Panel) v0.9.8.1122 that enables arbitrary code execution via a crafted POST request. Evidence from NVD shows a critical CVSS v3.1 score (9.8) and CVSS v2 score (10.0). Affected component: loader.php...
CVE-2022-25046
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
Wavlink WL-WN575A3 命令注入漏洞
Wavlink WL-WN575A3 is a wireless network signal extender from China RuiYin Technology Wavlink. A security vulnerability exists in the Wavlink WL-WN575A3 RPT75A3.V4300.201217 version, which stems from a command injection vulnerability discovered via the obtw function. An attacker could use this...
PT-2022-17062 · Cwp · Cwp
Name of the Vulnerable Software and Affected Versions: CWP version 0.9.8.1122 Description: A path traversal vulnerability in loader.php allows attackers to execute arbitrary code via a crafted POST request. Recommendations: For CWP version 0.9.8.1122, consider disabling the loader.php file until ...
EUVD-2022-37544
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request...
Simple Membership < 4.1.3 - Membership Privilege Escalation
The plugin does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request. Note: This only affects membership from the plugin, not the WordPress role To increase the level, the attacker nee...
Simple Membership < 4.1.3 - Membership Privilege Escalation
The plugin does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request. Note: This only affects membership from the plugin, not the WordPress role PoC To increase the level, the attacker...
CVE-2022-32310
An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php...
CVE-2022-32310
An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php...
PT-2022-21222 · Unknown · Ingredients Stock Management System
Name of the Vulnerable Software and Affected Versions: Ingredient Stock Management System version 1.0 Description: An access control issue allows attackers to take over user accounts via a crafted POST request to "/isms/classes/Users.php". Recommendations: For Ingredient Stock Management System...
Cross-site scripting - Stored via upload ".pages" file
Description In file upload function, the server allow upload .pages file with contain some javascript code lead to XSS. Proof of Concept REQUEST: POST /demo/plupload HTTP/1.1 Host: demo.microweber.org Cookie: laravelsession=r768Tqzv8h0fkjgvKdofhxgmjcorT6pwuqMKJkIb;...
OAuth Single Sign On < 6.22.6 - Authentication Bypass
The plugin doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address. POST / HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...
Cross site scripting
Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post request when sending an email and injecting a specially crafted XSS payload in the 'subject' field. The payload executes when the recipient logs...
Cross-Site Request Forgery in Jenkins vRealize Orchestrator Plugin
A cross-site request forgery CSRF vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL...
GHSA-35R9-GFQF-R6CW Missing permission check in Jenkins vRealize Orchestrator Plugin
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL...