PT-2024-39103 · Unknown · Code-Projects Online Shoe Store

Name of the Vulnerable Software and Affected Versions: code-projects Online Shop Store version 1.0 Description: A problematic vulnerability was found in the code-projects Online Shop Store, affecting unknown code of the file /settings.php. The manipulation of the error argument leads to cross-sit...

PT-2024-29365

Name of the Vulnerable Software and Affected Versions openflights commit 5234b5b Description The issue is related to Cross-Site Scripting XSS via the php/settings.php file. This allows for potential malicious script execution. No information is provided about the estimated number of affected...

OpenFlights 安全漏洞

OpenFlights is a tool by Jani Patokallio individual developer. It can map flights around the world. A security vulnerability exists in OpenFlights version 5234b5b, which stems from the presence of a cross-site scripting XSS vulnerability via php/settings.php...

PT-2024-38681 · Sourcecodester · Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A problematic vulnerability has been found in the system, affecting an unknown function of the file /php-ycrs/classes/SystemSettings.php. The manipulation of the address...

CVE-2024-7677

A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is the function updatesettingsinfo of the file /classes/SystemSettings.php?f=updatesettings. The manipulation of the argument contact/address...

PT-2024-29662 · Fog · Fog

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10.41 Description: The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file, which is readable by all users on the host. This allows a malicious user to exploit these...

CVE-2024-5551

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicat...

PT-2024-36536 · WordPress · Wp Staging Pro

Name of the Vulnerable Software and Affected Versions: WP STAGING Pro WordPress Backup Plugin versions up to, and including, 5.6.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sub parameter. This allows unauthenticated attacke...

BIT-GRADLE-2021-29427 Repository content filters do not work in Settings pluginManagement

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies...

CVE-2024-2149

A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed ...

CodeAstro Membership Management System SQL Injection Vulnerability

CodeAstro Membership Management System is a membership management system from CodeAstro. A SQL injection vulnerability exists in CodeAstro Membership Management System version 1.0, which originates from a SQL injection vulnerability in the parameter currency in the file settings.php...

PT-2024-18906 · Unknown · Codeastro Membership Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Membership Management System version 1.0 Description: A critical issue was found in the CodeAstro Membership Management System, affecting the file settings.php. The manipulation of the currency argument leads to SQL injection. This...

Stupid Simple CMS Security Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS v1.2.4 and earlier versions, which stems from a cross-site request forgery CSRF vulnerability in component/savesettings.php...

PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution

Summary Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via LoadSettingsFile. Details The loader being imported from the yaml library is...

PT-2023-31157 · Google · Google-Api-Python-Client

Name of the Vulnerable Software and Affected Versions: PyDrive2 versions prior to 1.16.2 Description: PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserialization will result in arbitrary code execution. A maliciously...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

Code injection

Installer RCE on settings file write in MyBB before 1.8.22...

CVE-2020-22612

CVE-2020-22612 affects MyBB prior to 1.8.22. The issue is an Installer Remote Code Execution (RCE) vulnerability caused by settings file writes during installation. Impact is high (RCE via installer) as described in multiple sources. The only remediation provided in the connected documents is to ...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

PT-2023-29001 · Unknown · Tdevs Hyip Rio

Name of the Vulnerable Software and Affected Versions: tdevs Hyip Rio version 2.1 Description: A problematic issue has been found in the Profile Settings component, specifically in the /user/settings file, where the manipulation of the avatar argument leads to cross-site scripting. This issue can...