CVE-2020-35929

In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data...

File Upload Vulnerability in HadSky Backend

HadSky is a PHP + MySQL based open source forum program. A file upload vulnerability exists in the backend of HadSky. An attacker can exploit this vulnerability to gain server privileges...

Security update for openldap2 (moderate)

openSUSE Security Update: Security update for openldap2 Announcement ID: openSUSE-SU-2021:0107-1 Rating: moderate References: 1178909 1179503 Cross-References: CVE-2020-25709 CVE-2020-25710 Affected Products: openSUSE Leap 15.2 An update that fixes two vulnerabilities is now available. Descriptio...

CVE-2021-23835

CVE-2021-23835 affects flatCore prior to 2.0.0 build 139. The issue is a local file disclosure in the docs_file HTTP request body parameter of the acp interface, which accepts malicious user input and can reveal sensitive backend files (e.g., /etc/passwd, SQLite DBs, PHP source) when an attacker ...

SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2021:0129-1)

This update for openldap2 fixes the following issues : Security issues fixed : CVE-2020-25709: Fixed a crash caused by specially crafted network traffic bsc1178909. CVE-2020-25710: Fixed a crash caused by specially crafted network traffic bsc1178909. Non-security issue fixed : Retry binds in the...

SUSE-SU-2021:0129-1 Security update for openldap2

This update for openldap2 fixes the following issues: Security issues fixed: - CVE-2020-25709: Fixed a crash caused by specially crafted network traffic bsc1178909. - CVE-2020-25710: Fixed a crash caused by specially crafted network traffic bsc1178909. Non-security issue fixed: - Retry binds in t...

SQL injection vulnerability in miku cms backend cm***_bo***_ed***.php file

Miku cms is a movie and TV management system designed for webmasters with different needs. A SQL injection vulnerability exists in the cmboed.php file in the backend of Miku cms. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9006)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9006 advisory. - xen-blkback: set ring-xenblkd to NULL after kthreadstop Pawel Wieczorkiewicz Orabug: 32260252 CVE-2020-29569 - xenbus/xenbusbackend: Disallow...

SQL Injection Vulnerability in Nacos Backend

Nacos is the latest open source project from Alibaba. Nacos backend has a SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...

CVE-2021-3133

The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages...

CVE-2021-3133

The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages...

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

Flawed Logic Vulnerability in YunMok Backend

YUNMOK adopts PHP + MYSQL as the programming language, through the module and visualization to achieve a technology-free website management operations, users are free to use, and the module can be freely edited, the template can be switched at will. YunMok backend has a logic flaw vulnerability,...

Logic flaw vulnerability in Waychar enrollment system backend

Waychar Registration System is a free race registration system. A logic flaw vulnerability exists in the backend of the Waychar registration system. An attacker can exploit this vulnerability to log directly into the backend...

CVE-2020-25680

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from...

Acronis: SSRF when configuring Website Backup on Acronis Cloud

Hi, I hope everything goes well. I have found a SSRF in https://mc-beta-cloud.acronis.com/ui//backup-console/resources when configuring the backup plan for a website. Summary While I was looking at the functionality of managing backups on websites, I saw that if you specify a local IP where to ge...

SQL Injection Vulnerability in Douxin Backend

douchat douxin is an open source framework that focuses on the development of WeChat. Douxin backend has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

SQL injection vulnerability in SeaCMS backend (CNVD-2021-03456)

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. A SQL injection vulnerability exists in the backend of SeaCMS. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL injection vulnerability in SeaCMS backend (CNVD-2021-03455)

SeaCMS Ocean CMS is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. A SQL injection vulnerability exists in the backend of SeaCMS. Attackers can use the vulnerability to obtain sensitive information in the database...