3954 matches found
Relative Path Traversal in afire serve_static
This vulnerability effects the built-in afire servestatic extension allowing paths containing //.... to bypass the previous path sanitation and request files in higher directories that should not be accessible...
CVE-2022-28434
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2...
CVE-2022-28425
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=...
CVE-2022-28018
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleedit.php...
GLPI 跨站脚本漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...
MISP 跨站脚本漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...
The vulnerability of the CKEditor WYSIWYG editor, related to the lack of measures taken to protect the structure of web pages, allows attackers to carry out XSS attacks.
The vulnerability of the CKEditor WYSIWYG editor is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow attackers to perform XSS attacks remotely...
Elcomplus SmartPPT 跨站请求伪造漏洞
Elcomplus SmartPPT is an integrated voice and data scheduling software from Elcomplus USA. Elcomplus SmartPPT suffers from a cross-site request forgery vulnerability that stems from a web application that cannot or does not adequately verify that a user submitting a request has intentionally...
PT-2022-16937 · Unknown · Http-Swagger
Name of the Vulnerable Software and Affected Versions: http-swagger versions prior to 1.2.6 Description: The issue allows an attacker to perform a denial of service attack consisting of memory exhaustion on the host system due to improper handling of HTTP methods. This can also lead to other...
snipe-it 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. snipe-IT has a security vulnerability that can be exploited by attackers to steal user cookies...
CVE-2022-27369
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component newsNews.phphy...
Cisco SD-WAN vManage Software 跨站请求伪造漏洞
Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco, U.S. A cross-site request forgery vulnerability exists in Cisco SD-WAN vManage Software, which can be exploited by attackers to perform arbitrary actions at the affected user...
CVE-2021-43742
CMSimple 5.4 is vulnerable to Cross Site Scripting XSS via the file upload feature...
CVE-2022-28034
AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMSadminajaxlist-sort.php...
Citrix Systems Citrix StoreFront Server 跨站脚本漏洞
Citrix Systems Citrix StoreFront Server Citrix StoreFront Server,Citrix StoreFront Server is a Citrix Systems Citrix Systems is an indispensable component of Xen virtualization as part of the authentication and delivery management process. Citrix StoreFront Server, Citrix StoreFront Server, Citri...
Jfinal CMS跨站脚本漏洞
Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1.0 has a cross-site scripting vulnerability, the vulnerability...
CVE-2022-27131
An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-27348
Social Codia SMS v1 was discovered to contain a stored cross-site scripting XSS vulnerability via addpost.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field...