GHSA-888J-PJQH-FX58 Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...

CVE-2024-11215

Absolute path traversal incorrect restriction of a path to a restricted directory vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only...

PT-2024-16833

Name of the Vulnerable Software and Affected Versions EasyPHP version 14.1 Description The issue is an absolute path traversal vulnerability, which could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server. This is achieved by setting consecutive...

PT-2024-35219 · Zij Kart · Zij Kart

Name of the Vulnerable Software and Affected Versions: ZIJ KART versions n/a through 1.1 Description: The issue affects ZIJ KART due to an improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2024-8518 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer-BigData versions 7.4.0 and prior to 7.2.7 Description: The issue is related to errors in handling relativ...

Hewlett Packard Enterprise ArubaOS 安全漏洞

Hewlett Packard Enterprise ArubaOS HPE ArubaOS is a networked wireless operating system from Hewlett Packard Enterprise. A security vulnerability exists in Hewlett Packard Enterprise ArubaOS, which stems from an authenticated path traversal vulnerability that could allow an attacker to remotely...

CVE-2024-10766

A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/saveuser.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated...

The vulnerability of the GetConfPath() function in the Nginx UI server’s user interface allows a hacker to write arbitrary files.

The vulnerability of the GetConfPath function in the Nginx UI server’s user interface is related to the improper handling of JSON fields, resulting in incorrect values being retrieved without proper validation. This issue arises due to a faulty restriction on the path to the restricted directory...

PT-2024-33195 · Sas · Sas Studio

Name of the Vulnerable Software and Affected Versions: SAS Studio version 9.4 Description: The issue allows a remote attacker to access internal files by manipulating the default path during file download through the /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath endpoint, using...

CVE-2024-50457

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Qode Qode Essential Addons qode-essential-addons.This issue affects Qode Essential Addons: from n/a through = 1.6.3...

CVE-2024-50436

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Theme Horse Clean Retina.This issue affects Clean Retina: from n/a through 3.0.6...

CVE-2024-50457

: Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.6.3...

CVE-2024-50435

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through = 1.1.7...

CVE-2024-50434

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in themehorse NewsCard newscard.This issue affects NewsCard: from n/a through = 1.3...

CVE-2024-50435

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Theme Horse Meta News.This issue affects Meta News: from n/a through 1.1.7...

CVE-2024-50434

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Theme Horse NewsCard.This issue affects NewsCard: from n/a through 1.3...

CVE-2024-50434

CVE-2024-50434 : Local File Inclusion in WordPress Theme NewsCard (versions <= 1.3) due to improper control of filename in include/require statements. This may enable an unauthenticated attacker to include arbitrary local files via crafted input, potentially leading to code execution. A fix is...

CVE-2024-50435

CVE-2024-50435 affects WordPress Theme Meta News (Theme Horse Meta News) up to version 1.1.7. It is a Local File Inclusion in PHP via improper control of the include/require filename. Patchstack reports a fixed version: 1.1.8. Connected sources confirm the vulnerability type and the fix, includin...

CVE-2024-50457

CVE-2024-50457 is a Local File Inclusion vulnerability in the WordPress plugin Qode Essential Addons (versions

CVE-2024-50497

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BuyNowDepot Advanced Online Ordering and Delivery Platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through 2.0...