PT-2023-22614

Name of the Vulnerable Software and Affected Versions CLTPHP versions prior to 6.1 Description The issue concerns an unrestricted upload of files with dangerous types. This is possible via the application/admin/controller/Template.php update function. Recommendations For versions prior to 6.1,...

CVE-2023-30269: Improper Input Validation

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

PT-2023-22619

Name of the Vulnerable Software and Affected Versions CLTPHP versions 6.0 and earlier Description The issue is related to Improper Input Validation. It affects the application/admin/controller/Template.php file. Recommendations For CLTPHP versions 6.0 and earlier, at the moment, there is no...

CVE-2023-30269

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

The vulnerability of the remote function (application\admin\controller\Upload.php) in the tpAdmin library allows a attacker to perform an SSRF attack.

The vulnerability of the remote function in the application\admin\controller\Upload.php file of the tpAdmin library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack...

CVE-2023-1971

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to laun...

Online Ordering System 跨站脚本漏洞

Online Ordering System is a multi-store ordering system for janobe individual developers. It can be used for any small business. A cross-site scripting vulnerability exists in SourceCodester Gadget Works Online Ordering System version 1.0, which stems from a problem with the file...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957: Missing Authorization

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

PT-2022-27637 · Sens · Sens

Name of the Vulnerable Software and Affected Versions: SENS version 1.0 Description: The issue is related to Cross Site Scripting XSS via the com.liuyanzhao.sens.web.controller.admin controller, specifically the getRegister function. This allows for potential malicious script execution...

SENS 跨站脚本漏洞

SENS is an enterprise blog system by saysky individual developer. A cross-site scripting vulnerability exists in SENS v1.0, which originates from a cross-site scripting attack XSS on com.liuyanzhao.sens.web.controller.admin, getRegister...

CVE-2022-44351

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

CVE-2022-43183

XXL-Job before v2.3.1 contains a Server-Side Request Forgery SSRF via the component /admin/controller/JobLogController.java...

PT-2022-26790 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job versions prior to 2.3.1 Description: The issue is related to a Server-Side Request Forgery SSRF in the component /admin/controller/JobLogController.java. This allows for potential exploitation. Recommendations: For versions prior to...

GHSA-QC43-PGWQ-3Q2Q Shopware access control list bypassed via crafted specific URLs

Impact If backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Patches We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or...

CVE-2022-28096

Skycaiji v2.4 was discovered to contain a remote code execution RCE vulnerability via /SkycaijiApp/admin/controller/Develop.php...

CVE-2022-26630

Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php...

XpressEngine 跨站脚本漏洞

XpressEngine XE is a CMS Content Management System that allows anyone to publish content easily, conveniently and freely. With an open source license, anyone can use or modify it, and as an open project, anyone can participate in its development. XE suffers from a security vulnerability that stem...