88 matches found
CVE-2021-47667
The CVE-2021-47667 vulnerability affects ZendTo (versions 5.24-3 through 6.x before 6.10-7). It is an OS command injection in lib/NSSDropoff.php that allows unauthenticated remote attackers to run arbitrary commands via shell metacharacters in the tmp_name parameter during a POST /dropoff. Impact...
CVE-2025-32352
ZendTo prior to version 5.04-7 contains a type confusion in lib/NSSAuthenticator.php that can allow remote attackers to bypass authentication for users whose passwords are stored as MD5 hashes that can be interpreted as numbers. The described remediation is to move from MD5 to bcrypt. Public refe...
CVE-2021-47667
An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmpname parameter when dropping off a file via a POST /dropoff request...
CVE-2021-27888
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
CVE-2021-27888
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
Cross site scripting
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
CVE-2021-27888
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
CVE-2021-27888
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
CVE-2021-27888
CVE-2021-27888 affects ZendTo prior to version 6.06-4 Beta. The issue is a cross-site scripting (XSS) vulnerability triggered during the display of a drop-off when a filename contains unexpected characters. Connected sources consistently describe the same flaw across multiple aggregations. The su...
ZendTo Cross-Site Scripting Vulnerability
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. A cross-site scripting vulnerability exists in versions prior to ZendTo 6.06-4 Beta during the display of drop-down menus with file names containing unexpect...
PT-2021-17647
Name of the Vulnerable Software and Affected Versions: ZendTo versions prior to 6.06-4 Beta Description: The issue allows for XSS during the display of a drop-off in which a filename has unexpected characters. Recommendations: For versions prior to 6.06-4 Beta, update to version 6.06-4 Beta or...
CVE-2021-27888: Improper Neutralization of Input During Web Page Generation
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters...
ZendTo 跨站脚本漏洞
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. A cross-site scripting vulnerability exists in versions prior to ZendTo 6.06-4 Beta during the display of drop-down menus with file names containing unexpect...
ZendTo Elevation of Privilege Vulnerability
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An elevation of privilege vulnerability exists in versions prior to ZendTo 5.22-2 Beta. The vulnerability stems from lib/NSSDropbox.php in ZendTo failing to...
ZendTo IP Address Spoofing Vulnerability
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. An IP address spoofing vulnerability exists in lib/NSSDropbox.php in versions prior to ZendTo 5.22-2 Beta. An attacker can exploit this vulnerability via the...
ZendTo Reflective Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities
ZendTo is a completely free web-based system that lets you conveniently send or receive files with no limit on file size and faster speeds. A reflected cross-site scripting and cross-site request forgery vulnerability exists in the unlock.tpl unlock user feature in ZendTo prior to version 5.22-2...
CVE-2020-8984
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...
CVE-2020-8985
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality...
CVE-2020-8986
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...