CVE-2022-26271

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...

CVE-2022-26271

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...

CVE-2022-26271

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...

PT-2022-17757

Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.4.1 Description The issue allows for an arbitrary file read via the url parameter at the indexcontrollerDownload.php endpoint. Recommendations For 74cmsSE version 3.4.1, avoid using the url parameter in the...

Cross site scripting

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-27920

The CVE-2022-27920 entry affects libkiwix (versions 10.0.0 and 10.0.1) with an XSS flaw in the built‑in webserver through the search suggestions URL parameter. The root cause involves improper handling of that URL parameter, enabling cross-site scripting. The vulnerability is fixed in version 10....

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-27920: Improper Neutralization of Input During Web Page Generation

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

CVE-2022-25221

Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to execute JavaScript code...

Command injection

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware...

CVE-2021-45876: Improper Neutralization of Special Elements used in a Command

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware...

PT-2022-12446

Name of the Vulnerable Software and Affected Versions GARO Wallbox versions affected versions not specified Description The issue concerns unauthenticated command injection in multiple versions of the software. Specifically, the url parameter of the downloadAndUpdate function module is vulnerable...

CVE-2022-25485

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php...

CVE-2022-25485

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php...

CVE-2022-25485

CuppaCMS v1.0 contains a Local File Inclusion in /alerts/alertLightbox.php via the url parameter. Affected component: CuppaCMS 1.0; root cause: insufficient input validation leading to LFI. Impact per sources: unauthorized access to sensitive files; potential remote code execution and system comp...

CVE-2022-25486

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php...

CVE-2022-25485: Inclusion of Functionality from Untrusted Control Sphere

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php...

PT-2022-17320

Name of the Vulnerable Software and Affected Versions CuppaCMS version 1.0 Description The issue is related to a local file inclusion via the url parameter in the /alerts/alertLightbox.php endpoint. This allows for potential unauthorized access to local files. Recommendations For CuppaCMS version...

CVE-2022-25486: Inclusion of Functionality from Untrusted Control Sphere

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...