Unauthorized Access Vulnerability in Tongda OA

Tongda OA is a collaborative office automation software. Tongda OA has an unauthorized access vulnerability that can be exploited by attackers to bypass login and directly enter the background...

SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2020:0722-1)

This update for nghttp2 fixes the following issues : nghttp2 was update to version 1.40.0 bsc1166481 lib: Add nghttp2checkauthority as public API lib: Fix the bug that stream is closed with wrong error code lib: Faster huffman encoding and decoding build: Avoid filename collision of static and...

SUSE-SU-2020:0722-1 Security update for nghttp2

This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 bsc1166481 - lib: Add nghttp2checkauthority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static...

XSS vulnerability in XYHCMS backend

XYHCMS is an open source CMS content management system. XYHCMS XSS vulnerability exists in the background , an attacker can exploit the vulnerability to inject arbitrary Web script or HTML...

CVE-2020-10578

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

Arbitrary file deletion

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

WMCMS backend templates have arbitrary file download vulnerability

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS background templates exist arbitrary file download vulnerability. Attackers can use this vulnerability to download arbitrary files...

SQL Injection Vulnerability in Joyplus CMS ad***_ap***_co***.php File

Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . Joyplus CMS adapco.php file contains a SQL...

Arbitrary File Deletion Vulnerability in ShopXO Backend

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO backend arbitrary file deletion vulnerability exists. Attackers can use the vulnerability to delete arbitrary files , resulting in a system crash , program reinstallation...

Multiple vulnerabilities in extension "Magalone Flipbook for TYPO3" (magaloneflipbook)

An authenticated backend user can use the backend module to upload arbitrary files resulting in Remote Code Execution. Also, the backend module is susceptible to path traversal which allows an authenticated backend user to upload and overwrite files in all locations the webserver has access to...

Arbitrary File Deletion Vulnerability in CLTPHP Backend

CLTPHP is a content management system based on ThinkPHP5 development with Layui framework in the backend. An arbitrary file deletion vulnerability exists in the CLTPHP backend. An attacker can exploit the vulnerability to delete arbitrary files...

Arbitrary File Deletion Vulnerability in SeaCMS Backend

SeaCMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. An arbitrary file deletion vulnerability exists in the SeaCMS backend. An attacker can exploit this vulnerability to delete arbitrary files on the web server...

Command Execution Vulnerability in Ocean CMS Backend (CNVD-2020-23723)

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. An arbitrary command execution vulnerability exists in the backend of Ocean CMS. An attacker can exploit this vulnerability to gain control of the web server...

Command Execution Vulnerability in Ocean CMS Backend

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. An arbitrary command execution vulnerability exists in the backend of Ocean CMS. An attacker can exploit this vulnerability to gain control of the web server...

File upload vulnerability in CLTPHP backend

CLTPHP is a content management system based on ThinkPHP5 development with Layui framework in the backend. A file upload vulnerability exists in the CLTPHP backend. An attacker can exploit the vulnerability to write php files and gain server privileges...

The Internet Avoided a Minor Disaster Last Week

A tiny backend bug at Let’s Encrypt almost broke millions of websites. A five-day scramble ensured it didn’t...

Visma Bug Bounty Program: [IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.

Insecure Direct Object Reference IDOR vulnerability is discovered via a certain endpoint and the application exposes a reference to an internal implementation object. It reveals the real identifier and format/pattern used of the element in the storage backend side...

Joyplus CMS suffers from SQL injection vulnerability (CNVD-2020-21950)

Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . Joyplus CMS has a SQL injection vulnerability , a...

Joyplus CMS suffers from an arbitrary file deletion vulnerability (CNVD-2020-21947)

Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . Joyplus CMS has an arbitrary file deletion...

Joyplus CMS suffers from SQL Injection Vulnerability

Joyplus CMS Joy Video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . Joyplus CMS has a SQL injection vulnerability ,...