CVE-2021-38833

SQL injection vulnerability in PHPGurukul Apartment Visitors Management System AVMS v. 1.0 allows attackers to execute arbitrary SQL statements and to gain RCE...

Sql injection

SQL injection vulnerability in PHPGurukul Apartment Visitors Management System AVMS v. 1.0 allows attackers to execute arbitrary SQL statements and to gain RCE...

CVE-2021-24620

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

CVE-2021-24493

The shoppuploadfile AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading t...

Design/Logic Flaw

The shoppuploadfile AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading t...

Cross site request forgery (csrf)

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

CVE-2021-24620 Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

CVE-2021-24620

The CVE-2021-24620 issue affects WordPress Simple Ecommerce Shopping Cart Plugin (versions

CVE-2021-24493 Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload

The shoppuploadfile AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading t...

CVE-2021-24493

The CVE-2021-24493 entry describes a vulnerability in the Shopp WordPress plugin (≤1.4) where the shopp_upload_file AJAX action allows unauthenticated and authenticated users to upload arbitrary files (e.g., PHP shells) without security checks, enabling remote code execution. The available connec...

CVE-2021-33551 UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code...

CVE-2021-33545 UDP Technology/Geutebrück camera devices: Buffer overflow in counter parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code...

CVE-2021-38833

CVE-2021-38833 affects PHPGurukul Apartment Visitors Management System (AVMS) v1.0. A SQL injection flaw enables attackers to execute arbitrary SQL and potentially achieve remote code execution (RCE). Root cause: unsafe SQL handling in the application. Documented impact includes arbitrary SQL exe...

CVE-2021-38833

SQL injection vulnerability in PHPGurukul Apartment Visitors Management System AVMS v. 1.0 allows attackers to execute arbitrary SQL statements and to gain RCE...

Prototype Pollution in antfu/utils

Description @antfu/utils is a collection of common JavaScript / TypeScript utils. It is vulnerable to Prototype Pollution on the deepMerge function. This allows for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. About the vulnerability Prototype Pollution...

Apartment Visitor Management System (AVMS) 1.0 - 'username' SQL Injection

Exploit Title: Apartment Visitor Management System AVMS 1.0 - 'username' SQL Injection Date: 2021-08-13 Exploit Author: mari0x00 Vendor Homepage: https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/ Software Link:...

Apartment Visitor Management System 1.0 Shell Upload / SQL Injection

Exploit Title: Apartment Visitor Management System AVMS 1.0 - SQLi to RCE Date: 2021-08-13 Exploit Author: mari0x00 Vendor Homepage: https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/ Software Link: https://phpgurukul.com/?smdprocessdownload=1&downloadid=10395 Versio...

CVE-2021-40146

A Remote Code Execution RCE vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class...

Remote code execution

A Remote Code Execution RCE vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class...

CVE-2021-40146

CVE-2021-40146 concerns a Remote Code Execution (RCE) in the Apache Any23 project, specifically in the YAMLExtractor.java file. The vulnerability is described as affecting Any23 versions earlier than 2.5, enabling an attacker to execute arbitrary code on a remote system over network connections. ...