1119 matches found
Unspecified Vulnerability in CKEditor Image Uploader and Browser
CKEditor is a set of open source, web-based text editor. Image Uploader and Browser is one of the image upload and download plugin. A security vulnerability exists in the pluginconfig.php file in versions of Image Uploader and Browser prior to 4.1.9 used in CKEditor, which stems from the program...
CVE-2019-19502
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2019-19502
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2019-19502
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2019-19502
This CVE affects Image Uploader and Browser for CKEditor (pluginconfig.php) prior to version 4.1.9. The root cause is a code injection vulnerability that allows remote authenticated users to execute arbitrary PHP code. Impact is scope-wide on affected deployments, with high risk per CVSS in the p...
CVE-2019-19502: Improper Control of Generation of Code
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2011-4972
hookfiledownload in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request...
Server side request forgery (ssrf)
hookfiledownload in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request...
CVE-2011-4972
CVE-2011-4972 affects CKEditor 7.x-1.4 for Drupal. The hook_file_download routine fails to properly restrict access to private files, enabling an attacker to read private files via a direct request. Affected product: CKEditor module (Drupal contrib) version 7.x-1.4. Root cause: improper access co...
CVE-2011-4972
hookfiledownload in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request...
CVE-2011-4972: Exposure of Sensitive Information to an Unauthorized Actor
hookfiledownload in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request...
Chamilo LMS 1.11.8 Shell Upload Exploit
Exploit for php platform in category web applications PHP Test FILE UPLOAD'; $tgtdir = "uploads/"; $tgtfile = $tgtdir.basename$FILES'fileToUpload''name'; echo "TARGET FILE= ".$tgtfile; //$filename = $FILES'fileToUpload''name'; echo "FILE NAME FROM VARIABLE:- ".$FILES"fileToUpload""name...
Chamillo LMS 1.11.8 - Arbitrary File Upload Exploit
Exploit for php platform in category web applications Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload Google Dork: "powered by chamilo" Exploit Author: Sohel Yousef jellyfish security team Software Link: https://chamilo.org/en/download/ Version: Chamilo 1.11.8 or lower to 1.8 Category:...
Chamillo LMS 1.11.8 - Arbitrary File Upload
Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload Google Dork: "powered by chamilo" Date: 2018-10-05 Exploit Author: Sohel Yousef jellyfish security team Software Link: https://chamilo.org/en/download/ Version: Chamilo 1.11.8 or lower to 1.8 Category: webapps 1. Description Any registere...
Chamillo LMS 1.11.8 - Arbitrary File Upload
Chamillo LMS 1.11.8 - Arbitrary File Upload Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload Google Dork: "powered by chamilo" Date: 2018-10-05 Exploit Author: Sohel Yousef jellyfish security team Software Link: https://chamilo.org/en/download/ Version: Chamilo 1.11.8 or lower to 1.8...
Cross-Site Scripting
Overview Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The createPreviewButton function fails to sanitize the href attribute of a created tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 10.0....
WordPress ckeditor-for-wordpress plugin cross-site scripting vulnerability
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. ckeditor-for-wordpress is an editor plugin used in it. A cross-site scripting vulnerability exists in the 'built-in old...
Adobe ColdFusion CKEditor Directory Traversal (CVE-2018-15960)
A directory traversal vulnerability exists in Adobe ColdFusion CKEditor component. The vulnerability is due improper sanitation of paths before writing files. Successful exploitation of this vulnerability could allow an attacker to write files to arbitrary locations on the target system...