File Upload Vulnerability in the Backend of UWA Universal Building System

UWA is a general-purpose website builder based on PHP and MySQL. UWA general-purpose site-building system background file upload vulnerability , the vulnerability is due to the UWA background allows customized php template files , and in the saving of the content of the PHP file does not do the...

SQL Injection Vulnerability in UQCMS Cloud Business System (CNVD-2020-26524)

UQCMS cloud business system is programmed with PHP + MYSQL, the template uses smarty templates, the front and back end is separated from a B2B2C e-commerce software. UQCMS Cloud Business System has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information...

SQL injection vulnerability in the sh***.cl***.php file of UQCMS cloud business system

UQCMS cloud business system is programmed with PHP + MYSQL, the template uses smarty templates, the front and back end is separated from a B2B2C e-commerce software. UQCMS cloud business system sh.cl.php file SQL injection vulnerability, an attacker can use the vulnerability to obtain database...

Gutenberg & Elementor Templates Importer For Responsive < 2.2.6 - Unprotected AJAX Endpoints

These flaws allowed any authenticated user, regardless of privilege level, the ability to execute various AJAX actions 23 that could reset site data, inject malicious JavaScript in pages, modify theme customizer data, import .xml and .json files, and activate plugins, among many other actions. Al...

WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 2.2.5 - Unprotected AJAX Actions vulnerability

Unprotected AJAX Actions vulnerability discovered by WordFence in WordPress Gutenberg & Elementor Templates Importer For Responsive plugin versions = 2.2.5. Solution Update the WordPress Gutenberg & Elementor Templates Importer For Responsive plugin to the latest available version at least 2.2.6...

PT-2020-11994 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.16 Description: An issue was discovered where various actions in com templates lack the required ACL checks, leading to potential attack vectors. Recommendations: For versions prior to 3.9.16, update to version...

PT-2020-11997 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.16 Description: An issue was discovered in the image actions of com templates, where missing token checks lead to CSRF. Recommendations: For versions prior to 3.9.16, update to version 3.9.16 or later to resolve...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18329)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9. The...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17368)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language version ...

Joomla! access control error vulnerability (CNVD-2020-20997)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in Joomla! versions 2.5.0 through 3.9.15, which stems from a failure to perform ACL checks for various...

CVE-2020-10492

CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request...

CVE-2020-10472

Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10431

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-templates.php by adding a question mark ? followed by the payload...

WMCMS backend templates have arbitrary file download vulnerability

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS background templates exist arbitrary file download vulnerability. Attackers can use this vulnerability to download arbitrary files...

CVE-2019-13007

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption...

CVE-2019-13007

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption...

CVE-2019-13007

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption...

CVE-2019-13011

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

CVE-2019-13007

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption...

CVE-2019-13007

GitLab Community/Enterprise Edition 11.11–12.0.2 contains an Uncontrolled Resource Consumption vulnerability: when an admin enables a service template, an action is triggered that leads to resource depletion and potential availability impact. Remediation: upgrade to GitLab 12.0.3 or later (securi...