CVE-2026-45054

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page admin.php?g=orders&node=transactions builds a raw ORDER BY SQL fragment from the attacker-controlled $GET'sort' array without column or direction validation. Both the column key and the directio...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

CVE-2024-34832: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

Discuz X3.2的milu_seotool插件存在本地文件包涵漏洞

0x01漏洞简介 Discuz X3.2的miluseotool插件存在本地文件包涵漏洞。 看见木有有个微信登陆功能，漏洞也出现在这里。无截断所以不鸡肋。 0x02漏洞分析 接下来看代码，文件在source\plugin\wechat\wechat.class.php： static public function redirect$type global $G; $hook = unserialize$G'setting''wechatredirect'; if !$hook || !inarray$hook'plugin', $G'setting''plugins''availabl...