Ruijie Networks BCR810W 操作系统命令注入漏洞

The Ruijie Networks BCR810W is an intelligent cloud router from Ruijie Networks China. An operating system command injection vulnerability exists in the Ruijie Networks BCR810W version 2.5.10. An attacker could exploit this vulnerability to conduct an OS command injection attack...

Simplephpscripts News Script PHP Pro 跨站脚本漏洞

Simplephpscripts News Script PHP Pro is a Php Mysql based news distribution system from Simplephpscripts Bulgaria. A cross-site scripting vulnerability exists in SimplePHPscripts News Script PHP Pro version 2.4, which stems from a problem with the file /preview.php that can lead to cross-site...

PT-2023-25209 · Unknown · Simplephpscripts Photo Gallery

Name of the Vulnerable Software and Affected Versions: SimplePHPscripts Photo Gallery PHP version 2.0 Description: A problematic vulnerability was found in the URL Parameter Handler component of the file /preview.php. This issue leads to cross site scripting and can be initiated remotely...

Newsletter 跨站脚本漏洞

Newsletter is a one-click bulk email solution. SimplePHPscripts NewsLetter Script A cross-site scripting vulnerability exists in PHP version 2.4, which stems from a problem with the file /preview.php that can lead to cross-site scripting...

PT-2023-25208 · Unknown · Simplephpscripts News Script Php Pro

Name of the Vulnerable Software and Affected Versions: SimplePHPscripts News Script PHP Pro version 2.4 Description: A problematic vulnerability has been found in the URL Parameter Handler component of the /preview.php file, leading to cross-site scripting. The attack can be initiated remotely...

DuxCMS 路径遍历漏洞

DuxCMS is an open source content management system. A security vulnerability exists in DuxCMS version 2.1, which stems from a directory traversal vulnerability that allows an attacker to delete arbitrary files via /admin/AdminBackup/del...

yt-dlp 信息泄露漏洞

yt-dlp is based on the youtube-dl branch of the now-inactive youtube-dlc. An information disclosure vulnerability previously existed in yt-dlp version 2023.07.06, which stemmed from an external downloader used by the app that could leak cookies when HTTP redirected to other hosts...

PT-2023-25562

Name of the Vulnerable Software and Affected Versions mtrojnar osslsigncode versions 2.3 and earlier Description The issue allows a local attacker to execute arbitrary code via crafted .exe, .sys, and .dll files. This is due to a Buffer Overflow vulnerability. Recommendations For mtrojnar...

PT-2023-24941 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member WordPress plugin versions prior to 2.6.7 Description: The issue allows attackers to create user accounts with arbitrary capabilities, effectively enabling them to create administrator accounts at will. This is being actively...

POS Codekop 访问控制错误漏洞

POS Codekop is an application. A security vulnerability exists in POS Codekop version v2.0 that stems from a corrupted authentication mechanism that allows an unauthenticated attacker to download sales data...

CVE-2020-18416

An cross site request forgery CSRF vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to modify payment information...

CVE-2020-18413

Stored cross site scripting XSS vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute arbitrary code...

PT-2023-11500 · Unknown · Chaoji Cms

Name of the Vulnerable Software and Affected Versions: Chaoji CMS version 2.18 Description: A stored cross site scripting XSS issue allows attackers to execute arbitrary code via the "/index.php?admin-master-webset" API endpoint. This enables attackers to inject malicious scripts into the...

Chaojicms 跨站脚本漏洞

Chaojicms is a super Cms web management system. A security vulnerability exists in Chaojicms v2.18, which originated from a discovery via /index.php?admin-master-article-edit that contains a cross-site scripting vulnerability. The vulnerability is exploited by an attacker to gain administrator...

WordPress plugin WP Brutal AI SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exists i...

Chaojicms 跨站脚本漏洞

Chaojicms is a super Cms web management system. A security vulnerability exists in Chaojicms v2.18, which originated from a cross-site scripting vulnerability found to be contained via /index.php?admin-master-navmenu-add. An attacker could exploit this vulnerability to gain administrator privileg...

UBUNTU-CVE-2023-22359

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

WAGO 输入验证错误漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed for use in industrial environments where digital algorithms operate electronic systems. An input validation error vulnerability exists in the WAGO PFC200 Family, which can be exploited by an...

PT-2023-22482 · Fpc +1 · Fpc +1

Name of the Vulnerable Software and Affected Versions: SMM versions 1 and 2 FPC affected versions not specified Description: A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands that the...

Lenovo ThinkSystem 安全漏洞

Lenovo ThinkSystem is a ThinkSystem series server device from Lenovo, a Chinese company. A security vulnerability exists in Lenovo ThinkSystem. An attacker exploited the vulnerability to execute commands without sufficient privileges on SMM v1, SMM v2, and FPC using specially designed Web...