[20201105] - Core - User Enumeration in backend login

Improper handling of the username leads to a user enumeration attack vector in the backend login page...

Sql injection

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php...

Command Execution Vulnerability in Empire CMS v7.5 Backend

EmpireCMS Empire Content Management System is an open source content management system CMS. A command execution vulnerability exists in the Empire CMS v7.5 backend, which can be exploited by an attacker to gain access to the web server...

XSS Vulnerability in LAYUI MINI Backend Admin Template

LAYUI MINI backend administration template is a set of the most simple and easy to use backend framework template based on Layui. LAYUI MINI backend administration template has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

File Upload Vulnerability in WeCenter 3.6.0 Admin Backend

WeCenter is an open source knowledge-based social Q&A community program. A file upload vulnerability exists in the WeCenter 3.6.0 administration background, which can be exploited by an attacker to upload a webshell and gain server privileges...

TPshop open source mall management backend System page there are arbitrary file deletion vulnerability

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall management backend System page there are arbitrary file vulnerability, an attacker can exploit the vulnerability to delete arbitrary files...

Destoon B2B Content Management System Backend File Inclusion Vulnerability

DESTOON® B2B Website Management System is an open source B2B e-commerce industry portal solution based on PHP+MySQL. A file inclusion vulnerability exists in the backend of the Destoon B2B content management system, which can be exploited by attackers to gain server administrative privileges...

DP3T-Backend-SDK Data Forgery Issue Vulnerability

DP3T-Backend-SDK is a backend implementation of DP3T Decentralized Privacy Preserving Neighborhood Tracking. A security vulnerability exists in DP3T-Backend-SDK versions prior to 1.1.1. An attacker can exploit the vulnerability to bypass signature checking...

Logic Flaw Vulnerability in LeShang Mall Open Source System (CNVD-2020-50730)

LeShangMall is a lightweight mall website management system, based on Thinkphp5+Mysql architecture, can run on Linux, Windows, MacOSX, Solaris and other platforms, the template is separated from the program, support for custom pseudo-static, the front template using DIV + CSS design can be orient...

Code Injection Vulnerability in Destoon B2B Website Management System Backend co***.in***.php File

DESTOON B2B website management system is a PHP MySQL based open source B2B e-commerce industry portal solution. Destoon B2B website management system backend co.in.php file has a code injection vulnerability. An attacker can exploit the vulnerability to remotely execute commands...

Arbitrary Code Execution Vulnerability in Verydows Backend

Verydows is a completely free and open source e-commerce management system developed using PHP, featuring cross-platform, lightweight, high performance, high load and security stability. Verydows backend arbitrary code execution vulnerabilities, attackers can exploit the vulnerability to obtain...

File Upload Vulnerability in Verydows 2.0 Backend

Verydows is a free and open source e-commerce management system developed using PHP, featuring cross-platform, lightweight, high performance and strong security. Verydows 2.0 backend file upload vulnerability, attackers can exploit the vulnerability to obtain server privileges...

Command Execution Vulnerability in UsualToolCMS Backend

UsualToolCMS UTCMS is a content management system and rapid site building framework. A command execution vulnerability exists in the backend of UsualToolCMS, which can be exploited by attackers to gain server privileges...

SQL Injection Vulnerability in CMS Backend of Luoyang Yunye Information Technology Co.

Yunye CMS enterprise building system is a php open source cms specialized in small and medium-sized enterprise website construction. Luoyang Yunye Information Technology Co., Ltd. Yunye CMS background SQL injection vulnerability , attackers can use the vulnerability to obtain sensitive informatio...

Code Execution Vulnerability in KiteCMS Backend

KiteCMS open source web content management system CMS, the system is based on the framework ThinkPHP5.1. version of the development , applicable to individuals and enterprises to quickly build stations and development needs. Provide website templates for various industries , the system uses a...

[SECURITY] Fedora 31 Update: evolution-data-server-3.34.4-2.fc31

The evolution-data-server package provides a unified backend for programs t hat work with contacts, tasks, and calendar information. It was originally developed for Evolution hence the name, but is now used by other packages...

MacCMS has a file upload vulnerability

MacCMS is a cms website builder system. There is a file upload vulnerability in the MacCMS backend that allows attackers to utilize a self-constructed zip file upload trojan...

CVE-2020-15957

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing DP3T. When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none...

CVE-2020-15957

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing DP3T. When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none...

Code injection

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing DP3T. When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none...