PT-2024-38673 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: A critical vulnerability was found in DedeBIZ, affecting an unknown functionality of the file admin/media add.php of the component File Extension Handler. The manipulation of the argument upfile1 leads to...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ version 6.3.0, which stems from the parameter upfile1 in the file admin/mediaadd.php that can lead to unrestricted uploads...

CVE-2023-41623

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...

Sql injection

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...

PT-2023-28005 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog version pro2.1.14 Description: A SQL injection issue was discovered via the uid parameter at the "/admin/media.php" API endpoint. This allows for potential exploitation. Recommendations: For Emlog version pro2.1.14, consider restricting...

Emlog 安全漏洞

emlog is a PHP and MySQL based CMS builder for emlog personal developers. Emlog pro2.1.14 version of a security vulnerability, the vulnerability stems from the uid parameter in /admin/media.php contains SQL injection vulnerability. Attackers can use this vulnerability to gain unauthorized access ...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the profile image in the User settings section can be run in the update or in the uploa...

GHSA-7F84-9CQF-G4J9 Camaleon CMS vulnerable to Stored Cross-site Scripting

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false...

BloofoxCms 代码问题漏洞

BloofoxCms is alexlang24 BloofoxCms individual developers of a Php-based text content management system. BloofoxCms 0.5.2.1 version has a security vulnerability, the vulnerability stems from the existence of arbitrary file upload vulnerability via...

ZKEACMS 代码问题漏洞

ZKEACMS is an open source visually designed, WYSIWYG content management system. version 3.2.0 of ZKEACMS contains a security vulnerability that stems from an arbitrary file upload vulnerability in the application's "/admin/media/upload", which could be exploited to execute arbitrary code via a...

CVE-2020-5512

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

Path traversal

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

CVE-2020-5512

CVE-2020-5512 concerns Gila CMS 1.11.8, where the path parameter in the admin media interface (media-assets.php) is mishandled, enabling a path traversal to access files outside restricted directories. Multiple connected records corroborate this: CNVD-2020-03268 and PRlON/ CPAI-2020-0294 describe...

WBCE CMS File Rename Filter Bypass Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in the admin/media/rename.php file in WBCE CMS 1.4.0 and earlier versions. An attacker can exploit the vulnerability to rename media file names and extensions to execute arbitrary PHP...

CVE-2019-17536

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/mediaupload and fm/move...

CVE-2018-12988

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

Dotclear cross-site scripting vulnerability (CNVD-2017-00084)

Dotclear is a software developer OlivierMeunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/media.php and admin/mediaitem.ph files in versions of Dotclear prior to 2.11. A remote attacker can inject arbitrary web...

UBUNTU-CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

Information disclosure

Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap CVE-2005-2436...

Django Directory Traversal Vulnerability (Linux)

This host has Django installed and is prone to Directory Traversal Vulnerability. OpenVAS Vulnerability Test $Id: gbdjangodirtraversalvulnlin.nasl 5904 2017-04-10 06:18:08Z teissa $ Django Directory Traversal Vulnerability Linux Authors: Nikita MR Copyright: Copyright c 2009 Greenbone Networks...