CVE-2022-2864

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the /includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and...

CVE-2022-3464

A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument sitename leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this...

CVE-2022-36201

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

PT-2022-23258 · Unknown · Doctor Appointment System

Name of the Vulnerable Software and Affected Versions: Doctor's Appointment System version 1.0 Description: The issue concerns Incorrect Access Control, specifically Broken Access Control IDOR, in the settings.php file located at the /edoc/patient/ endpoint. The vulnerability is exploited via the...

Company Website CMS 访问控制错误漏洞

Company Website CMS is a company website/CMS by Torrahclef Personal Developer. Company Website CMS suffers from an Access Control Error vulnerability that stems from incorrect access control in the file site-settings.php of the component Cookie Handler. An attacker could use this vulnerability to...

CVE-2022-32320

A Cross-Site Request Forgery CSRF in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a settings/preferences file...

Backdoor.Win32.InfecDoor.17.c MVID-2022-0614 Insecure Permissions

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/1fd70e41918c3a75c634b1c234ec36fb.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.InfecDoor.17.c Vulnerability: Insecure Permissions Description: The malware...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

CVE-2021-40903

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static...

PT-2022-11331 · Unknown · Antminer Monitor

Name of the Vulnerable Software and Affected Versions: Antminer Monitor version 0.50.0 Description: A vulnerability exists in the Antminer Monitor due to a backdoor or misconfiguration inside a settings file in the flask server. The settings file contains a predefined secret string that is static...

CVE-2022-24387

With administrator or admin privileges the application can be tricked into overwriting files in appdata/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010...

CVE-2022-25094

Home Owners Collection Management System v1.0 was discovered to contain a remote code execution RCE vulnerability via the parameter "cover" in SystemSettings.php...

CVE-2021-45083

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobble...

PYSEC-2022-38

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobble...

Simple Chatbot Application 代码问题漏洞

Simple Chatbot Application is a chatbot application by Carlo Montero Personal Developer. A security vulnerability exists in Simple Chatbot Application 1.0 due to remote code execution in the botavatar parameter in SystemSettings.php...

The vulnerability of the settings.json file of the Microsoft Visual Studio Code editor allows a hacker to execute arbitrary code.

The vulnerability of the settings.json file of the Microsoft Visual Studio Code editor is related to improper handling of code generation. Exploiting this vulnerability may allow an attacker to execute arbitrary code...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin that stems from insufficient inp...

CVE-2021-38332

The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

On Page SEO + Whatsapp Chat Button < 1.0.2 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts...