PT-2024-18906 · Unknown · Codeastro Membership Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Membership Management System version 1.0 Description: A critical issue was found in the CodeAstro Membership Management System, affecting the file settings.php. The manipulation of the currency argument leads to SQL injection. This...

Stupid Simple CMS Security Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS v1.2.4 and earlier versions, which stems from a cross-site request forgery CSRF vulnerability in component/savesettings.php...

PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution

Summary Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via LoadSettingsFile. Details The loader being imported from the yaml library is...

PT-2023-31157

Name of the Vulnerable Software and Affected Versions PyDrive2 versions prior to 1.16.2 Description PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserialization will result in arbitrary code execution. A maliciously...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

Code injection

Installer RCE on settings file write in MyBB before 1.8.22...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

CVE-2020-22612

CVE-2020-22612 affects MyBB prior to 1.8.22. The issue is an Installer Remote Code Execution (RCE) vulnerability caused by settings file writes during installation. Impact is high (RCE via installer) as described in multiple sources. The only remediation provided in the connected documents is to ...

CVE-2020-22612: Improper Control of Generation of Code

Installer RCE on settings file write in MyBB before 1.8.22...

PT-2023-29001 · Unknown · Tdevs Hyip Rio

Name of the Vulnerable Software and Affected Versions: tdevs Hyip Rio version 2.1 Description: A problematic issue has been found in the Profile Settings component, specifically in the /user/settings file, where the manipulation of the avatar argument leads to cross-site scripting. This issue can...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

Personal Weather Station Dashboard 信任管理问题漏洞

Personal Weather Station Dashboard PWSDashboard is a data-rich weather dashboard from PWSDashboard open source. A security vulnerability exists in Personal Weather Station Dashboard. An attacker can exploit this vulnerability to execute remote code by injecting PHP code into settings.php...

PT-2023-14639 · Unknown · Pws Personal Weather Station Dashboard

Name of the Vulnerable Software and Affected Versions: PWS Personal Weather Station Dashboard PWS Dashboard version 2012 lts Description: The issue allows remote code execution by injecting PHP code into settings.php. Attacks can use the "PWS printfile.php", "PWS frame text.php", "PWS...

SUSE CVE-2012-5474

The file /etc/openstack-dashboard/localsettings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release python-django-horizon package before 2012.1.1 is world readable and exposes the secret key value...

Cloudflare WARP 输入验证错误漏洞

Cloudflare WARP Cloudflare Vpn is a client-side application for secure connections from Cloudflare, Inc. A security vulnerability in Cloudflare WARP, which stems from a lack of proper validation of the supporturi parameter in its client-side local settings file mdm.xml, allows an attacker to...

CVE-2022-3417

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import intentionally or not a malicious settings file and a suitable gadget chain is present on the blog...

CVE-2022-3417

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import intentionally or not a malicious settings file and a suitable gadget chain is present on the blog...

CVE-2022-3417 WPtouch < 4.3.45 - Admin+ PHP Object Injection

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import intentionally or not a malicious settings file and a suitable gadget chain is present on the blog...

WordPress Plugin Kadence WP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2022-3417: Undefined Security Weakness

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import intentionally or not a malicious settings file and a suitable gadget chain is present on the blog...