CVE-2025-24677

Improper Control of Generation of Code 'Code Injection' vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Remote Code Inclusion.This issue affects Post/Page Copying Tool: from n/a through = 2.0.3...

SiberianCMS 代码注入漏洞

SiberianCMS is an open source and free application manufacturing software from SiberianCMS Inc. A code injection vulnerability exists in SiberianCMS version 4.20.6, which originates in the file /app/sae/design/desktop/flat of the component HTTP GET request handler can lead to a cross-site scripti...

WordPress plugin WP ALL Export Pro 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability...

WordPress plugin WP ALL Export Pro 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability...

Animati PACS 代码注入漏洞

Animati PACS is a powerful and stable PACS system from Animati. A code injection vulnerability exists in Animati PACS version 1.24.12.09.03 and earlier, which stems from improper handling of the /login file parameter and could lead to a cross-site scripting attack...

CVE-2020-36085

Stored Cross Site ScriptingXSS vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary code via First and Last Name in Apply For This Job Form...

CVE-2021-37694

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream SCSt microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and al...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2022-43760

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web...

CVE-2022-21686

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-3721

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39...

CVE-2022-3401

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability CVE-2022-3400, makes it possible for authenticate...

CVE-2022-3696

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA...

CVE-2022-3713

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA...

CVE-2022-3236

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older...

CVE-2022-30527

A vulnerability has been identified in SINEC NMS All versions V2.0. The affected application assigns improper access rights to specific folders containing executable files and libraries. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges...

WordPress plugin CURCY 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

Mindskip xzs-mysql 代码注入漏洞

Mindskip xzs-mysql is a java + vue front-end and back-end separation of the examination system from Wuhan, China Mindskip Technology Mindskip company. The main advantages are simple and fast development and deployment, friendly interface design and clear code structure. Support web end and wechat...

CVE-2020-36085

The CVE-2020-36085 entry concerns Egavilan Media’s Resumes Management and Job Application Website (Version 1.0). It describes a Stored Cross Site Scripting (XSS) vulnerability in the Apply For This Job Form, where an attacker can inject arbitrary code via the First Name and Last Name fields. The ...

CVE-2020-36085

Stored Cross Site ScriptingXSS vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary code via First and Last Name in Apply For This Job Form...