54 matches found
PT-2024-31978
Name of the Vulnerable Software and Affected Versions Best House Rental Management System version 1.0 Description The issue concerns an arbitrary file upload vulnerability. This vulnerability is located in the save settings function of the file rental/admin class.php. Recommendations For Best Hou...
CVE-2024-7927: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin leads to path traversal. The attack can be launched remotely. The exploit has been...
PT-2024-4404 · Itsourcecode · Itsourcecode Banking Management System
Name of the Vulnerable Software and Affected Versions: itsourcecode Banking Management System version 1.0 Description: A critical issue was found in the Banking Management System, affecting an unknown functionality of the file admin class.php. The manipulation of the username argument leads to SQ...
CVE-2024-29275: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php...
PT-2024-22846 · Seacms · Seacms
Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php. This enables attackers to potentially access and manipulate...
PT-2024-18963 · Sourcecodester · Sourcecodester Best Pos Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Best POS Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file admin class.php. The manipulation of the img argument leads to sql injection. It is possibl...
PT-2024-15234 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DeDeCMS versions up to 5.7.112 Description: A critical vulnerability has been found in DeDeCMS, affecting an unknown function of the file file class.php in the Backend component. This vulnerability leads to unrestricted upload and can be...
Cross-site Scripting (XSS)
moodle/moodle is vulnerable to cross-site scripting. The vulnerability exists due to a lack of validation in the user-supplied input for field.class.php and helper.php which allows a remote attacker to inject and execute malicious JavaScript into the system...
CVE-2021-39357: Improper Neutralization of Input During Web Page Generation
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the /class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affec...
CASAP Automated Enrollment Cross-Site Scripting Vulnerability (CNVD-2021-57787)
CASAP Automated Enrollment is an automated enrollment system from the CASAP organization. The goal of the project is to provide CASAP with an automated enrollment system to streamline the school process and make it more effective, efficient and easily retrievable. SourceCodester CASAP Automated...
CVE-2021-27823
An information disclosure vulnerability was discovered in /index.class.php via port 8181 on NetWave System 1.0 which allows unauthenticated attackers to exfiltrate sensitive information from the system...
SQL Injection Vulnerability in Thunderwind Movie CMS Pl***.class.php
Thunderwind Movie CMS is a PHP based THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. Thunderwind Movie CMS Pl.class.php SQL injection vulnerability, attackers can use the vulnerability to obtain...
PT-2018-14970
Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description The issue concerns a SQL injection in the get ip function located in system/class/helper class.php. This occurs via the X-Forwarded-For HTTP header when accessing the "user/index.php?load=login&act=act login"...
Design/Logic Flaw
An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code...
CVE-2017-16949: Unrestricted Upload of File with Dangerous Type
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...
own-lingerie.com XSS vulnerability
Vulnerable URL: http://own-lingerie.com/class.php?id=13'"143 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure...
atopclass.com XSS vulnerability
Vulnerable URL: http://atopclass.com/class.php?id=13'"171 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1038408 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability...
Design/Logic Flaw
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "svg/onload=" substring instead of an "svg onload=" substring...
