The vulnerability of the SonicWall Secure Mobile Access (SMA 1000) software lies in its ability to bypass authentication procedures. This allows attackers to gain access to arbitrary files and directories stored outside of the root web directory.

The vulnerability of the SonicWall Secure Mobile Access SMA 1000 security access device lies in its ability to bypass authentication procedures. Exploiting this vulnerability allows a malicious actor to gain access to arbitrary files and directories stored outside of the root web directory...

CVE-2023-31067

An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILESX86%\TSplus\Clients\www...

SUSE CVE-2023-31132

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The use...

Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of certificate web directory. The issue...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

Information disclosure

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

CVE-2023-33518

CVE-2023-33518 affects emoncms versions 11 and later, with an information disclosure flaw that lets an attacker obtain the server’s web directory path and other leaked information via a crafted web request. The root cause is described as an information disclosure issue in emoncms v11+. Multiple s...

PT-2023-24374 · Emoncms · Emoncms

Name of the Vulnerable Software and Affected Versions: emoncms versions 11 and later Description: The issue allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request. This is an information disclosure vulnerability. Recommendations: For...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

CVE-2023-2201

The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

CVE-2023-2201

CVE-2023-2201 affects Web Directory Free for WordPress (plugin) up to version 1.6.7. Root cause: insufficient escaping and lack of prepared SQL in the post_id parameter, enabling an authenticated contributor to inject additional SQL into existing queries and potentially exfiltrate data. Public de...

CVE-2023-2201 Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id

The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

PT-2023-18361 · WordPress · Web Directory Free

Name of the Vulnerable Software and Affected Versions: The Web Directory Free for WordPress versions up to, and including, 1.6.7 Description: The issue allows authenticated attackers with contributor-level privileges to extract sensitive information from the database due to insufficient escaping ...

WordPress plugin Web Directory Free SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Web Directory Free Plugin <= 1.6.8 is vulnerable to SQL Injection

Software Web Directory Free Type Plugin Vulnerable versions = 1.6.8 Fixed in 1.6.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2201 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 1ca325af76e3 Credits Marco Wotschka Required privilege Contributor...

CVE-2023-26216

The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below...

Design/Logic Flaw

Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory...

CVE-2022-42029

CVE-2022-42029 affects Chamilo LMS 1.11.16. An authenticated local file inclusion vulnerability allows a user with access to the Big File Uploads feature to copy/move files from anywhere on the host filesystem into the web directory. Impact is described as high confidentiality, integrity, and a...