1606 matches found
CVE-2022-24677
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...
CVE-2022-24676
updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...
Remote code execution
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...
HYBBS 代码问题漏洞
HYBBS is a lightweight community forum program. A code issue vulnerability exists in HYBBS2, which stems from the product Admin.php page not checking for uploaded files during updates. An attacker can use this vulnerability to upload a carefully crafted ZIP archive file. The following products an...
CVE-2022-24676
CVE-2022-24676 affects HYBBS2 up to version 2.3.2, where the update_code flow in Admin.php allows arbitrary file upload via a crafted ZIP archive. The root cause is described as the Admin.php page not validating uploaded files during updates, enabling potential file upload abuse. Public reference...
CVE-2022-24677
CVE-2022-24677 affects HYBBS2 up to version 2.3.2. Admin.php writes plugin-related configuration information to conf.php, enabling remote code execution. The vulnerability is triggered on the Admin.php page and has been characterized with high/severe impact (NVD CVSS v3.1: 9.8, CRITICAL; v2: 7.5,...
CVE-2022-24677
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php...
Arbitrary file deletion
An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
The plugin does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored in their cookies with an XSS payloa...
Profile Extra Fields < 1.2.4 - Reflected Cross-Site Scripting
The plugin does not escape the role parameter when outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=profile-extra-fields.php&tab-action=userdata&role="alert/XSS/...
ZZCMS Access Control Error Vulnerability
ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS suffers from an access control error vulnerability that stems from an incorrect access control vulnerability in zzcms via admin.php, which can be exploited by an attacker to directly access the administrator console afte...
Improper access control
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...
CVE-2021-43703
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console...
Directory traversal
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php...
CVE-2020-18438
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php...
CVE-2020-18438
CVE-2020-18438 is a directory traversal vulnerability in qinggan/phpok 5.1. The flaw allows an attacker to disclose sensitive information by manipulating the title parameter in admin.php. This is documented across multiple connected sources (NVD entry and CNVD/CNNVD variants) confirming the affec...
qinggan phpok 路径遍历漏洞
phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. A directory traversal vulnerability exists in phpok version 5.1. The vulnerability can be exploited to disclose sensitive information via the title parameter of admin.php...
Ibtana - Ecommerce Product Addons < 0.2.4 - Reflected Cross-Site Scripting
The plugin does not escape some user input before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. v alert/XSS/ v 0.2.4 - https://example.com/wp-admin/admin.php?page=ibtana-custom-post-type&posttypeid="+style=animation-name:rotation+onanimationstart=alert/XSS/...