Remote file inclusion

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

CVE-2017-12071: Server-Side Request Forgery (SSRF)

Server-side request forgery SSRF vulnerability in fileupload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter...

Googlemaps Plugin Denial of Service Vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters development team developed a set of open source content management system CMS, it provides RSS feeds, site search and other features. Googlemaps is one of the set of Google Maps plug-ins. A security vulnerability exists in the Joomla! Googlemaps plugin that...

PT-2017-12336

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.4-3433 Synology Photo Station versions prior to 6.3-2968 Description A server-side request forgery SSRF issue exists in the file upload.php file, allowing remote authenticated users to download...

CVE-2013-7428: Uncontrolled Resource Consumption

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugingooglemap2proxy.php...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the URL parameter in sso.php...

Remote code execution

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

CVE-2016-4462

CVE-2016-4462 concerns Apache OFBiz. A logged-in user can manipulate the externalLoginKey URL parameter to feed the Freemarker Template Engine with directives reflected on the page, enabling remote code execution via a specially crafted Freemarker template. Mitigation: upgrade to Apache OFBiz 16....

GSA Bounty: Content injection via URL parameter.

Hello, The following URL is vulnerable to content & code injection. https://labs.data.gov/dashboard/validate...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-28224)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 1.2.19 and prior to 1.3.0-beta.2. A remote...

Cross site scripting

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...

CVE-2014-9701

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...

CVE-2014-9701: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...

PT-2017-6390

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.19 MantisBT versions 1.3.x prior to 1.3.0-beta.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "permalink page.php"...

PT-2017-12590

Name of the Vulnerable Software and Affected Versions SLiMS versions 8 Akasia through 8.3.1 Description The issue is related to an arbitrary file reading problem due to directory traversal in the url parameter to "admin/help.php". This can be exploited by remote authenticated librarian users...

Hashtopussy Cross-Site Scripting Vulnerability

Hashtopussy is a cross-platform client-server tool for distributing hash table tasks between multiple computers, featuring portability, stability and multi-user support. A cross-site scripting vulnerability exists in Hashtopussy version 0.4.0. A remote attacker can exploit this vulnerability with...

Synology Photo Station Arbitrary File Download Vulnerability

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A server-side request forgery vulnerability exists in the fileupload.php file in Synology Photo Station versions prior to 6.7.4-3433 and 6.3-2968. A remote attacker can exploit the vulnerabilit...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

PT-2017-12121

Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9 Description The issue concerns URL Redirector Abuse via the url parameter in a sync action, related to the controllers/Weixin.php file. Recommendations For dayrui FineCms version 5.0.9, consider restricting access ...