ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

WPCargo < 6.9.0 - Unauthenticated RCE

The plugin contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE PoC import sys import binascii import requests This is a magic string that when treated as pixels and compressed using the png algorithm, will cause to be written ...

CVE-2022-25322

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

CVE-2022-25323

ZEROF Web Server 2.0 allows /admin.back XSS...

CVE-2022-25323

ZEROF Web Server 2.0 allows /admin.back XSS...

CVE-2022-25323

ZEROF Web Server 2.0 allows /admin.back XSS...

CVE-2022-25322

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

CVE-2022-25322

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

Cross site scripting

ZEROF Web Server 2.0 allows /admin.back XSS...

Sql injection

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

CVE-2022-25322

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

EUVD-2022-30005

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...

CVE-2022-25322

CVE-2022-25322 affects ZEROF Web Server 2.0, where the endpoint /HandleEvent is vulnerable to SQL Injection . The NVD/NVD-derived metrics list CVSS v3.1 base score 9.8 (CRITICAL) and CVSS v2 base 7.5 (HIGH);攻击面 is NETWORK with low complexity and no authentication. Connected sources describe explo...

CVE-2022-25323

ZEROF Web Server 2.0 allows /admin.back XSS...

CVE-2022-25323

CVE-2022-25323 affects ZEROF Web Server 2.0, with a cross-site scripting (XSS) vulnerability reachable via the /admin.back endpoint. Public docs identify CWE-79 and CVSS v3.1 base score 6.1 (NETWORK, LOW complexity, UI REQUIRED, changed scope; impact: confidentiality/integrity LOW, availability N...

Exploit for SQL Injection in Zerof Web_Server

Public CVE | CVE Number | Produc...

ZEROF Web Server SQL注入漏洞

ZEROF Web Server is an open source Web framework that simplifies modern Web development . It allows you to build applications without having to worry about package management or routing. ZEROF Web Server has a SQL injection vulnerability that allows HandleEvent SQL injection...

Drupal 9.2.x < 9.2.13 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.88, 9.2.x prior to 9.2.13, or 9.3.x prior to 9.3.6. It is, therefore, affected by multiple vulnerabilities: - The Quick Edit module does not properly check entity access in some...

PT-2022-17211

Name of the Vulnerable Software and Affected Versions ZEROF Web Server version 2.0 Description The issue allows for SQL Injection via the /HandleEvent endpoint. Recommendations For ZEROF Web Server version 2.0, consider restricting access to the /HandleEvent endpoint until a patch is available...

ZEROF Web Server跨站脚本漏洞

ZEROF Web Server is an open source Web framework that simplifies modern Web development . It allows you to build applications without having to worry about package management or routing. ZEROF Web Server has a security vulnerability , there is no information about the vulnerability , please keep...