CVE-2026-4121: Cross-Site Request Forgery (CSRF)

The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing nonce validation in the plugin's settings page handler admin/setting.php. The settings form does not include a wpnoncefield and the form processing code...

EUVD-2018-8533

Malware in sbrugna...

CVE-2025-60447: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...

CVE-2024-5043

A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2024-5043 Emlog Pro setting.php unrestricted upload

A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2024-5043

A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2024-5043: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

PT-2024-34204

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.3.4 Description: A critical issue affects some unknown functionality of the file admin/setting.php, leading to unrestricted upload. The attack may be launched remotely. The estimated number of potentially affected devices...

CVE-2024-4809: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched...

CVE-2024-4809 SourceCodester Open Source Clinic Management System setting.php unrestricted upload

A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched...

CVE-2024-4809 SourceCodester Open Source Clinic Management System setting.php unrestricted upload

A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched...

PT-2024-20925

Name of the Vulnerable Software and Affected Versions flusity-CMS version 2.33 Description The issue concerns an Unrestricted Upload of File with Dangerous Type in the update setting.php file. This allows for potential malicious file uploads. Recommendations For flusity-CMS version 2.33, as a...

CVE-2024-1115

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit h...

CVE-2024-1115 openBI Setting.php dlfile os command injection

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit h...

CVE-2024-1115

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit h...

openBI operating system command injection vulnerability

openBI is a big data visualization solution from openBI Inc. An OS command injection vulnerability exists in openBI prior to version 1.0.8, which stems from a problem with the dlfile function of the /application/websocket/controller/Setting.php file, which could lead to OS command injection...

CVE-2021-42866

A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php...

Cross site scripting

A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php...

PT-2022-11718

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A Cross Site Scripting issue exists in the software via the Site Description field in the "pixelimity/admin/setting.php" endpoint. Recommendations For Pixelimity version 1.0, consider disabling the Site...

CVE-2021-42866: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php...