22255 matches found
CVE-2024-11031 SSRF in binary-husky/gpt_academic
In version 3.83 of binary-husky/gptacademic, a Server-Side Request Forgery SSRF vulnerability exists in the MarkdownTranslate.getfilesfromeverything API. This vulnerability is exploited through the HotReloadMarkdown翻译中 plugin function, which allows downloading arbitrary web hosts by only checking...
CVE-2024-11031
In version 3.83 of binary-husky/gptacademic, a Server-Side Request Forgery SSRF vulnerability exists in the MarkdownTranslate.getfilesfromeverything API. This vulnerability is exploited through the HotReloadMarkdown翻译中 plugin function, which allows downloading arbitrary web hosts by only checking...
CVE-2024-11031
Vulnerability: binary-husky/gpt_academic v3.83 has an SSRF flaw in Markdown_Translate.get_files_from_everything() exploitable via the HotReload plugin, which trusts HTTP links to fetch arbitrary hosts and can leverage the victim GPT Academic’s Gradio Web server credentials. Documented impact: una...
CVE-2024-11030: Server-Side Request Forgery (SSRF)
GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery SSRF vulnerability through its HotReload plugin function, which calls the crazyutils.getfilesfromeverything API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic...
CVE-2024-11031: Server-Side Request Forgery (SSRF)
In version 3.83 of binary-husky/gptacademic, a Server-Side Request Forgery SSRF vulnerability exists in the MarkdownTranslate.getfilesfromeverything API. This vulnerability is exploited through the HotReloadMarkdown翻译中 plugin function, which allows downloading arbitrary web hosts by only checking...
CVE-2024-12376: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...
VulnCheck KEV: CVE-2022-0074
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1...
PHP check_has_header DoS
The vulnerability of the checkhasheader function in the PHP programming language is related to insufficient validation of input data when processing HTTP headers. Exploiting this vulnerability can allow an attacker to cause service failures...
Tenda RX3 Buffer Overflow Vulnerability (CNVD-2025-09161)
The Tenda RX3 is a home wireless router from Tenda, a Chinese company. The Tenda RX3 suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause the web server to crash, resulting in a denial of service...
CVE-2024-54449 Remote Code Execution (RCE) via Arbitrary File Write In Document API
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘writ...
CVE-2024-54449
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘writ...
CVE-2024-54448
CVE-2024-54448 concerns the LogicalDOC Automation Scripting feature, which an attacker with admin privileges or granted access can abuse to execute arbitrary commands on the web server hosting LogicalDOC. The vulnerability enables remote code execution on the underlying operating system via the A...
CVE-2024-54448 Remote Code Execution (RCE) via Automation Scripting
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation...
CVE-2024-54448: Improper Control of Generation of Code
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation...
Santesoft Sante PACS Server security vulnerabilities
Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. Used to store, archive, manage, view and burn medical images. A security vulnerability exists in Santesoft San...
Tenda RX3 security vulnerabilities
The Tenda RX3 is a home wireless router from Tenda, a Chinese company. The Tenda RX3 suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause the web server to crash, resulting in a denial of service...
CVE-2025-28915: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through = 1.2.9...
[SECURITY] Fedora 40 Update: man2html-1.6-39.g.fc40
man2html is a man page to HTML converter. This package contains CGI scripts that allow you to view, browse, and search man pages using a web server...