143 matches found
CVE-2022-24990
CVE-2022-24990 Description - POC for CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation. - create by antx at 2022-04-12. Detail - The vulnerability allows a remote attacker to execute arbitrary commands on the target system. - The vulnerability...
FineCMS <=5.0.10 - Cross-Site Scripting
FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...
CVE-2019-14537
YOURLS: PoC de CVE-2019-14537 Cuando obtengas una marca de tiempo válida, podrás realizar solicitudes a la api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats×tamp=VALIDTIMESTAMP Uso root@kitploit: usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip...
CVE-2017-8809_MediaWiki_RFD
CVE-2017-8809 - RFDReflected File Download for MediaWiki A remote user can create a specially crafted URL for the target site that, when loaded by the target user, will cause the 'api.php' script to download a file containing shell commands CVE-2017-8809. The file will be served by the target sit...
CVE-2026-19376 Uasoft Badaso File API api.php class permission
A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-14482 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an...
CVE-2026-14482
The CVE-2026-14482 entry covers the WordPress plugin “多说社会化评论框” (
UBUNTU-CVE-2026-58028
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php,...
CVE-2025-1186
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. The exploit has been...
EUVD-2021-19282
Malware in sbrugna...
EUVD-2013-1836
Malware in sbrugna...
EUVD-2017-11165
Malware in sbrugna...
EUVD-2018-8202
Malware in sbrugna...
EUVD-2018-12584
Malware in sbrugna...
EUVD-2018-20707
Malware in sbrugna...
EUVD-2018-6822
Malware in sbrugna...
EUVD-2024-21555
Malicious code in bioql PyPI...
EUVD-2023-58880
Malicious code in bioql PyPI...
EUVD-2021-30593
Malicious code in bioql PyPI...
PT-2025-37390
Name of the Vulnerable Software and Affected Versions: eCharge Hardy Barth Salia PLCC version 2.2.0 Description: A security flaw exists in eCharge Hardy Barth Salia PLCC 2.2.0 related to unrestricted upload. The issue affects processing of the file /api.php. Manipulation of the setrfidlist argume...