217 matches found
CVE-2022-24989: Improper Neutralization of Special Elements in Output Used by a Downstream Component
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. Shell metacharacters can be placed in raidtype because popen is used without any sanitization...
CVE-2022-24989
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. Shell metacharacters can be placed in raidtype because popen is used without any sanitization...
Improper Privilege Management
microweber/microweber is vulnerable to Improper Privilege Management . The vulnerability exists due lack of authorization checks in the apiResource parameter of api.php which allows an attacker to provide malicious configuration-related API parameter...
CVE-2023-1442 Meizhou Qingyunke QYKCMS Update api.php unrestricted upload
A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /adminsystem/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the...
CVE-2023-1442 Meizhou Qingyunke QYKCMS Update api.php unrestricted upload
A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /adminsystem/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the...
CVE-2015-10094 Fastly Plugin api.php post cross site scripting
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. Upgrading to version...
CVE-2015-10094: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. Upgrading to version...
Default credentials
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response...
CVE-2022-24990: Missing Authentication for Critical Function
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response...
Sql injection
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...
CVE-2022-4889 visegripped Stracker api.php getHistory sql injection
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...
CVE-2022-4889: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...
CVE-2017-20168
A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommende...
Sql injection
A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommende...
CVE-2017-20168: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommende...
CVE-2022-4564: Cross-Site Request Forgery (CSRF)
A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to...
PT-2022-10074
Name of the Vulnerable Software and Affected Versions viaviwebtech Android EBook App version 10 Description The issue is related to a SQL Injection vulnerability. It can be exploited via the author id parameter to the "api.php" endpoint. Recommendations For version 10, avoid using the author id...
CVE-2021-32428: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in viaviwebtech Android EBook App Books App, PDF, ePub, Online Book Reading, Download Books 10 via the authorid parameter to api.php...