WordPress plugin Chained Quiz 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-27457 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.6.0 Description: A cross-site scripting XSS issue exists in the Url parameter of the "/login.php" API endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For EyouCMS...

PT-2022-27030 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 44.5 Description: The issue concerns the url parameter of the "/api/geojson" endpoint, which can be exploited to perform Server Side Request Forgery attacks. It is noted that previously implemented blacklists could ...

Mitel MiCollab 代码问题漏洞

Mitel MiCollab is a mobile application from Mitel Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. A security vulnerability exists in Mitel MiCollab version 9.5.0.101 and prior versions, which stems from an insufficiently restricted URL...

CVE-2022-41496

iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery SSRF via the url parameter at admincp.php...

CVE-2022-41526

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function...

BaijiaCMS 代码问题漏洞

BaijiaCMS Baijia CMS is a Java Quest soft player from BaijiaCMS Inc. A security vulnerability exists in BaijiaCMS version v4.1.4, which originates from a vulnerability that allows remote attackers to force an application to make a request by injecting an arbitrary URL into the url parameter...

Online Diagnostic Lab Management System 跨站脚本漏洞

Online Diagnostic Lab Management System is an online diagnostic lab management system. A cross-site scripting vulnerability exists in Online Diagnostic Lab Management System version 1.0, which originates from an XSS via the firstname, address, middlename, lastname , gender, email, contact...

CVE-2022-37810

Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac...

CVE-2022-37075

TOTOLink A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg...

CVE-2022-35535

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to command injection in page /wifimesh.shtml...

CVE-2022-34580

Advanced School Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the address parameter at ip/school/index.php...

CVE-2022-34580

Advanced School Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the address parameter at ip/school/index.php...

CVE-2022-34580

Advanced School Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the address parameter at ip/school/index.php...

CVE-2022-34580

CVE-2022-34580 affects Advanced School Management System v1.0. The issue is a cross-site scripting (XSS) vulnerability exploitable via the address parameter at ip/school/index.php. Documented CVSS: 4.8 (MEDIUM) with network attack vector, high privileges required and user interaction. APT/Exploit...

Advanced School Management System 跨站脚本漏洞

Advanced School Management System is a school management system by the individual developer Angel Jude Reyes Suarez. A security vulnerability exists in Advanced School Management System v1.0, which originates from a cross-site scripting XSS vulnerability found in the address parameter of...

PT-2022-16952 · Wavlink · Wavlink Wn535G3 +1

Name of the Vulnerable Software and Affected Versions: WAVLINK WN535K2 WAVLINK WN535K3 Description: A critical issue affects the unknown processing of the file /cgi-bin/touchlist sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the...

CVE-2022-31208

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmdstring URL parameter...

The vulnerability of the Microprogrammed Software for Infiray IRAY-A8Z3 thermal imagers arises from incorrect code generation control, allowing a intruder to execute arbitrary code.

The vulnerability of the Infiray IRAY-A8Z3 thermal imager’s microprogramming software is related to incorrect handling of the code generation process. Exploiting this vulnerability could allow an intruder to execute arbitrary code using the cmdstring URL parameter...

PT-2022-11471 · Zeroshell · Zeroshell

Name of the Vulnerable Software and Affected Versions: ZeroShell version 3.9.5 Description: The issue is a command injection vulnerability in the "/cgi-bin/kerbynet" API endpoint, specifically in the IP parameter. This may allow an authenticated attacker to execute system commands. Recommendation...