CVE-2022-26267: Missing Authentication for Critical Function

Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...

Piwigo 访问控制错误漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 12.2.0, which was discovered via an information leak in the action parameter in...

PT-2022-8593 · Alfresco · Alfresco Community Edition

Name of the Vulnerable Software and Affected Versions: Alfresco Community Edition versions 5.2.0 through 6.1 Description: A Cross Site Scripting XSS issue exists via the action parameter in the "alfresco/s/admin/admin-nodebrowser" API endpoint. This allows for potential exploitation. The issue is...

CVE-2020-18327: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2...

Authenticated-RCE-CuppaCMS

Authenticated-RCE-CuppaCMS CuppaCMS is vulnerable to Authentic...

CVE-2021-24973

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsraction AJAX action available to unauthenticated and any authenticated users, allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard...

CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

PT-2021-23761

Name of the Vulnerable Software and Affected Versions GOautodial versions prior to commit 3c3a979 Description The issue allows an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. This is possible because t...

CVE-2021-43176: Relative Path Traversal

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

CVE-2021-35059

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...

CVE-2021-35059: Improper Neutralization of Input During Web Page Generation

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...

Geutebruck instantrec Remote Command Execution Exploit

This Metasploit module exploits a buffer overflow within the 'action' parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions equal to 1.12.0.27 as well as firmware versions 1.12.13.2 and...

CVE-2021-33549

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code...

PT-2021-20196

Name of the Vulnerable Software and Affected Versions Geutebrück camera devices affected versions not specified UDP Technology camera devices affected versions not specified Description The issue is related to a stack-based buffer overflow condition in the action parameter, potentially allowing a...

CVE-2021-33549: Stack-based Buffer Overflow

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code...

CVE-2021-24438

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'gaaction' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24438

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'gaaction' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue...

多款 Geutebrück 摄像头设备缓冲区错误漏洞

Geutebrück G-Code EEC-2xxx and others are products of Geutebrück Germany.Geutebrück G-Code EEC-2xxx is an analog video encoder module.Geutebrück G-Cam EBC-21xx is an EBC-21xx series network camera. Geutebrück G-Cam EFD-22xx is an EFD-22xx series network camera. geutebrück G-Cam E2 and others are...

PT-2021-10891

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.6 Description The issue allows remote attackers to upload a swf file, which can be injected with arbitrary web script or HTML, via the action parameter in the "common/static/plugin/ueditor/1.4.3.3/php/controller.php" API...