SUSE CVE-2024-2756

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

CMSimple 安全漏洞

CMSimple is a free content management system from CMSimple open source. A security vulnerability exists in CMSimple version 5.16, which stems from a vulnerability that allows remote attackers to download php backup files via a carefully crafted script that obtains sensitive information...

PT-2024-21656 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SO Planning versions prior to 1.52.02 Description: A Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, an attacker can upload a PHP-file that will be available for...

Online ID Generator 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online ID Generator 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits | ...

Online Survey System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Survey System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits |...

Loan Management System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Loan Management System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits...

Employees Pay Slip PDF Generator System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Employees Pay Slip PDF Generator System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefo...

PT-2024-12118 · Softexpert · Softexpert Excellence Suite

Name of the Vulnerable Software and Affected Versions: Softexpert Excellence Suite version 2.1 Description: A file upload issue allows attackers to execute arbitrary code by uploading a .php file to the "form/efms exec html/file upload parser.php" endpoint. Recommendations: For Softexpert...

flusity CMS 安全漏洞

flusity CMS is a user interactive interface solution where code can be easily changed or added. A security vulnerability exists in flusity CMS version v.2.33, which stems from issues that allow remote attackers to execute arbitrary code via the addpost.php component...

Huashi Private Cloud CDN Live Streaming Acceleration Server 安全漏洞

Huashi Private Cloud CDN Live Streaming Acceleration Server is a live streaming acceleration service from China Huashi. A security vulnerability exists in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport version v.1.1.2, which originates from a vulnerability that allow...

PT-2023-32429 · WordPress · Rtmedia

Name of the Vulnerable Software and Affected Versions: rtMedia for WordPress, BuddyPress and bbPress WordPress plugin versions prior to 4.6.16 Description: The issue concerns the rtMedia plugin's failure to validate uploaded files, potentially allowing attackers with low-privilege accounts to...

CVE-2023-48381

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...

CVE-2023-48965

An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file...

PT-2023-7576 · Unknown · Sticky Notes App Using Php With Source Code

Name of the Vulnerable Software and Affected Versions: Sticky Notes App Using PHP with Source Code version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This vulnerability can be exploited by a remote attacker to gain access to confidential information...

CVE-2023-46793

Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...

qdPM Code Issues Vulnerabilities

qdPM is a web-based open source project management tool. A security vulnerability exists in qdPM version 9.2, which stems from a remote code execution vulnerability. The vulnerability allows an attacker to upload a .php file to the /uploads URI via the Add Attachments function to execute remote...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

CSZ CMS 代码问题漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSKaza CSZ CMS version 1.2.2, which originates from a vulnerability that allows attackers to execute arbitrary commands and code via a crafted PHP file...

laravel-admin 代码问题漏洞

z-song laravel-admin is an administrative interface builder for the Laravel web development framework. A security vulnerability exists in laravel-admin v1.8.19, which stems from the existence of an arbitrary file upload vulnerability that can be exploited by an attacker to execute arbitrary code...

PT-2023-19069 · Erohtar · Dasherr

Name of the Vulnerable Software and Affected Versions: erohtar/Dasherr versions prior to 1.05.00 Description: The issue allows any unauthenticated user to execute arbitrary code on the server due to unrestricted file upload. The file /www/include/filesave.php enables uploading files to anywhere o...