QNAP NAS Malware Remover Command Injection Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of QNAP NAS. Authentication is required to exploit this vulnerability. The specific flaw exists within the Malware Remover application. A crafted TAR file in the file system can trigger execution of a syste...

QNAP NAS MusicStation Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of QNAP NAS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MusicStation application. When parsing the arttype request parameter, the process...

CVE-2021-32615

Piwigo 11.4.0 allows admin/userlistbackend.php order0dir SQL Injection...

PT-2021-19808

Name of the Vulnerable Software and Affected Versions Piwigo version 11.4.0 Description The issue allows for SQL Injection through the order0dir parameter in the admin/user list backend.php endpoint. Recommendations For Piwigo version 11.4.0, as a temporary workaround, consider restricting access...

Chamilo 信息泄露漏洞

Chamilo is a learning management system focused on ease of use and accessibility. Chamilo version 1.11.14 suffers from an XML external entity injection vulnerability. The vulnerability stems from reading XML data without disabling the ability to load external entities in admin/userimport.php, whi...

PT-2021-3536

Name of the Vulnerable Software and Affected Versions Chamilo versions 1.11.x Description The issue is related to the admin/user import.php file in Chamilo, which reads XML data without properly disabling the ability to load external entities. This can lead to an XXE XML External Entity attack,...

CVE-2021-32573

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

Privilege escalation

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

PT-2021-19669

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.1 Description: A Stored XSS issue allows an admin authenticated user to inject arbitrary web script or HTML via the lname parameter in the interface/usergroup/usergroup admin.php file. Recommendations: For...

CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

Cross site request forgery (csrf)

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2020-23127

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2020-23127: Cross-Site Request Forgery (CSRF)

Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery CSRF via the edituser function by targeting an admin user...

CVE-2021-30224

Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...

CVE-2021-30224

The CVE-2021-30224 entry concerns Rukovoditel v2.8.3 vulnerable to Cross-Site Request Forgery (CSRF). The root cause is that the web application does not adequately verify request origin, allowing an attacker to create an admin user with arbitrary credentials. Affected software is Rukovoditel v2....