CVE-2024-44069: Missing Authorization

Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value Celsius, Fahrenheit,...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

PT-2015-4081

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1.1 through 3.3.x Description The issue allows remote attackers to read arbitrary files via the data parameter in certain configurations. This is due to an XML external entity XXE vulnerability in the admin/api.php fil...

CVE-2014-8790: Undefined Security Weakness

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...