942 matches found
Path Traversal
Overview Versions of servey prior to 3.x are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to the latest version References - HackerOne Report - GitHub Advisory...
Path Traversal
Overview Versions of http-live-simulator prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.0.6 References - HackerOne Report - GitHub Advisory...
phpFileManager 1.7.8 - Local File Inclusion
Exploit Title: phpFileManager 1.7.8 - Local File Inclusion Date: 01.04.2019 Exploit Author: Murat Kalafatoglu Vendor Homepage: https://sourceforge.net/projects/phpfm/ Software Demo: https://phpfm-demo.000webhostapp.com/ Version: v1.7.8 Category: Webapps Tested on: XAMPP for Linux Description: Any...
Path Traversal in localhost-now
All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made...
GHSA-QWJ8-P662-3M7X Path Traversal in localhost-now
All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made...
Arbitrary File Deletion Vulnerability in cszcms-1.2.1
CSZCMS is an open source web application that allows to manage all the content and settings on a website. An arbitrary file deletion vulnerability exists in cszcms-1.2.1, which can be exploited by an attacker to delete arbitrary files on the server when deleting an avatar...
HSYCMS suffers from arbitrary file download vulnerability
Hsycms is an enterprise-level web content management system, written by PHP+MYSQL, using template separation technology to support the creation of many types of sites. An arbitrary file download vulnerability exists in HSYCMS, which can be exploited by attackers to obtain sensitive file informati...
GHSA-3Q32-J57W-Q4W7 Path Traversal in total.js
Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml...
Path Traversal in total.js
Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml...
GHSA-45J8-PM75-5V8X Path Traversal in simplehttpserver
Versions of simplehttpserver prior to 0.2.1 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 0.2.1 or later...
Path Traversal in simplehttpserver
Versions of simplehttpserver prior to 0.2.1 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 0.2.1 or later...
GHSA-7C9W-QMRQ-FF8R Path Traversal in http-live-simulator
Versions of http-live-simulator prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: curl --path-as-is http://localhost:8080//../../../../etc/passwd. Recommendation Upgrade to version 1.0.7...
Path Traversal in http-live-simulator
Versions of http-live-simulator prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: curl --path-as-is http://localhost:8080//../../../../etc/passwd. Recommendation Upgrade to version 1.0.7...
CVE-2018-16493
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...
CVE-2019-6799
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...
CVE-2019-6799
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...
Path Traversal
Overview Versions of http-live-simulator prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: curl --path-as-is http://localhost:8080//../../../../etc/passwd. Recommendation Upgrade to...
Arbitrary File Download Vulnerability in LaySNS v2.40
LaySNS is a lightweight, ThinkPHP+Layui-based integrated website management system that integrates content management and community interaction. LaySNS v2.40 has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive file information on the server...
Directory Traversal Vulnerability in 56iq Digital Signage Software Frontend
56iq digital signage software is a digital signage content creation software, used to create exciting programs in plasma liquid crystal LCD flat-panel TVs, LED screens, projection equipment and other multimedia terminals playback and touch interactive applications. A directory traversal...