CVE-2021-26293

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...

Directory traversal

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...

Privilege Escalation

wordpress is vulnerable to privilege escalation. Using XML-RPC allows an unprivileged user to comment on a post as wp-includes/class-wp-xmlrpc-server.php does not enforce the permission to restrict it...

Sql injection

FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php...

CVE-2019-15555

FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php...

CVE-2019-15555

The CVE-2019-15555 entry concerns FredReinink Wellness-app. Multiple connected sources specify an SQL injection vulnerability affecting the Wellness-app before 2019-06-19, related to PHP scripts dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php. The issue enables potentially ...

CVE-2019-12939

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the pextrse parameter...

CVE-2018-17389

CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account...

Cross site request forgery (csrf)

CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account...

CVE-2018-17389

CVE-2018-17389 describes a CSRF flaw in the Live Call Support Application version 1.5, specifically in server.php, that allows adding an admin account. The root cause is a Cross-Site Request Forgery vulnerability that can enable unauthorized admin account creation without user interaction beyond ...

Deserialization of untrusted data

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2018-19892

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field...

CVE-2018-19892

DomainMOD 4.11.01 has a Cross-Site Scripting (XSS) vulnerability via the admin/dw/add-server.php DisplayName, HostName, or UserName fields. The Nuclei template specifies the path as /domain//admin/dw/add-server.php and describes a stored XSS that can execute arbitrary JavaScript in the victim’s b...

Sql injection

DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statemen...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

PT-2018-17520 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT version 2.10.0 Description: The issue allows local users to conduct SQL Injection attacks via the sql parameter in a request to the server.php endpoint, accessible from the 127.0.0.1 IP address. It is worth noting that the vendor...

hitek.fr XSS vulnerability

Vulnerable URL: http://hitek.fr/server.php?action=loadproducts Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 19:03 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11727 VIP website status:| Yes Check hitek.f...