47 matches found
CVE-2026-55584
CVE-2026-55584 - phpSysInfo IP 허용 목록 우회 CWE-290, CVSS 7.5 높음, phpSysInfo = 3.4.5 참조: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED는 REMOTEADDR로 폴백하기 전에 공격자가 제어하는 X-Forwarded-For그다음 Client-IP 헤더에서 클라이언트 IP를 결정합니다. 신뢰할 수 있는 프록시 개념이 없으므로, 허용된 IP를 스푸핑하면 허용 목록을 무력화하고 xml.php를 통해 전체 시스템 정보가 노출됩니다. PoC:...
CVE-2025-69212-PoC
CVE-2025-69212 — PoC d'injection de commandes OpenSTAManager P7M OpenSTAManager = 2.9.8 — Injection de commandes système via un nom de fichier .p7m malveillant dans un téléchargement ZIP. Fichier : src/Util/XML.php:100 — $file non assaini dans exec Vecteur : /plugins/importFEZIP/actions.php → ZIP...
PT-2026-94253
Name of the Vulnerable Software and Affected Versions sachertortephp affected versions not specified Description A logic error exists in the Xml::build static method within the lib/Cake/Utility/Xml.php file. The issue stems from incorrect operator precedence in a conditional statement intended to...
CVE-2026-41936: Improper Restriction of XML External Entity Reference
Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...
CVE-2017-20212: Improper Limitation of a Pathname to a Restricted Directory
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile function to access...
CVE-2017-20212
The CVE-2017-20212 entry concerns FLIR Thermal Camera F/FC/PT/D firmware 8.0.0.64. Affected component: the web application path /var/www/data/controllers/api/xml.php, where readFile() reads local files without authentication. Root cause: unverified input parameters allow information disclosure. I...
EUVD-2009-4825
Malware in sbrugna...
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...
GHSA-67GV-XRW7-P72W Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
CVE-2023-49006 affects Phpsysinfo 3.4.3 and is a Cross-Site Request Forgery (CSRF) vulnerability. The claim states that a crafted page in XML.php can cause a remote attacker to obtain sensitive information. Affected component is Phpsysinfo (XML.php as the attack surface); root cause is CSRF, enab...
phpSysInfo security vulnerability
phpSysInfo is phpSysInfo open source a customizable PHP script that does a great job of displaying information about your system. A security vulnerability exists in phpSysInfo version 3.4.3, which stems from a cross-site request forgery in XML.php...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
XML.php JSONP hijacking
Description The XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker. Proof of Concept We created an HTML file as a proof of concept to showcase the vulnerability. This HTML file will...