581 matches found
CVE-2023-2159
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmpbypass GET parameter in the URL equal to the md5-hashed homeurl in the default setting allows users to visit a site placed in maintenance mode th...
The vulnerability of the ping.cgi script in NETGEAR DGN2200 router’s embedded software allows a hacker to execute arbitrary commands and gain full control over the device.
The vulnerability of the ping.cgi script in NETGEAR DGN2200 router software exists because measures to neutralize specific elements used in the operating system command have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands on th...
CVE-2023-33617
An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...
CVE-2023-33617
An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...
Ellucian 跨站脚本漏洞
Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A cross-site scripting vulnerability exists in Ellucian Ethos Identity versions prior to 5.10.5, which stems from the presence of an unknown function in the file /cas/logout that leads to cross-site scripting via the...
Weaver E-Office 安全漏洞
Weaver E-Office is a collaborative office system from China's PanWei Technologies Weaver. A security vulnerability exists in Weaver E-Office version 9.5 and earlier versions, which is caused by an incorrect operation of the parameter url that results in absolute path traversal...
PT-2023-3384 · Tenda · Tenda Ac5
Name of the Vulnerable Software and Affected Versions: Tenda AC5 router version V15.03.06.28 Description: The issue is related to insufficient input validation in the Tenda AC5 router's firmware, which can be exploited by a remote attacker to execute arbitrary code using the Mac parameter at the...
The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software allows a hacker to execute arbitrary commands.
The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
CVE-2023-24729
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function...
Simple Customer Relationship Management SQL注入漏洞
Simple Customer Relationship Management Simple CRM is a simple customer relationship management system by Carlo Montero Personal Developer. A security vulnerability exists in Simple Customer Relationship Management System v1.0, which originates from a SQL injection vulnerability in the address...
Online Tours & Travels Management System 跨站脚本漏洞
Online Tours & Travels Management System is an online tour management system by Mayuri K. Individual developer. A cross-site scripting vulnerability exists in SourceCodester Online Tours & Travels Management System version 1.0, which stems from cross-site scripting due to incorrect manipulation o...
PT-2023-13001 · Fortinet · Fortianalyzer +1
Name of the Vulnerable Software and Affected Versions: FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.4 FortiAnalyzer versions prior to 6.4.8 Description: The issue is related to an improper neutralization of input during web page generation, which may allow a remote...
SUSE CVE-2015-7873
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...
SUSE CVE-2017-5453
A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...
SUSE CVE-2018-12327
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which nt...
SUSE CVE-2020-15692
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system...
Inline SVG 跨站脚本漏洞
Inline SVG is a library from the personal developer James Martin. SVG documents are styled for use on the Web using CSS by adding classes to the document and embedding them in HTML. A cross-site scripting vulnerability exists in Inline SVG that stems from unknown functionality in the file...
PT-2023-12632 · Sourcecodester · Sourcecodester Royale Event Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Royale Event Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown function of the file /royal event/companyprofile.php. The manipulation of the companyname, regno,...
Printer 命令注入漏洞
Printer is a tool open-sourced by Exciting. Explore IoT printing possibilities. Printer suffers from a command injection vulnerability that stems from incorrect manipulation of the parameter URL leading to command injection...