36 matches found
CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC
CVE-2020-29607 — Pluck CMS تنفيذ أوامر عن بُعد موثّق في Pluck CMS قبل الإصدار 4.7.13. لا يتحقق مدير الملفات الخاص بالمشرف admin.php?action=files من امتدادات الملفات، مما يسمح برفع ملفات .phar التي ينفذها Apache كـ PHP. يؤدي رصد شل ويب عبر هذه النقطة إلى تنفيذ الأوامر كمستخدم خادم الويب. كيف يعمل ...
CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal
A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...
CVE-2026-16219
CVE-2026-16219 affects Croogo CMS versions up to 4.0.7. The vulnerability lies in the Admin File Manager component, specifically FileManager::isEditable in FileManager/src/Utility/FileManager.php, leading to path traversal. Exploitation can be performed remotely; a working exploit has been publis...
CVE-2026-25558
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
CVE-2026-25558
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
CVE-2026-25558 QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
CVE-2026-25558
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
EUVD-2026-35071
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
CVE-2026-25558 QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
CVE-2026-25558
CVE-2026-25558 affects QloApps up to version 1.7.0. The issue is a stored cross-site scripting flaw in the admin file manager, permitting an authenticated administrator to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed event handlers (e.g., onload) in SVGs uploade...
CVE-2026-25558 QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
PT-2026-47296
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded throu...
QloApps 跨站脚本漏洞
QloApps is an open-source hotel management and reservation system developed by QloApps. Versions of QloApps 1.7.0 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting vulnerability in the administrator’s file manager. It...
Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck
CVE-2020-29607 — Pluck CMS Authenticated remote code executio...
CVE-2018-18823
WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/filemanager/browse/...
EUVD-2018-10539
Malware in sbrugna...
EUVD-2018-8219
Malware in sbrugna...
EUVD-2020-3935
Malware in sbrugna...