OpenEMR 跨站脚本漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. cross-site scripting vulnerabilities exist in versions of OpenEMR prior to...

CVE-2022-23409

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

Design/Logic Flaw

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

CVE-2022-23409

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

CVE-2022-23409

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

CVE-2022-23409: Improper Limitation of a Pathname to a Restricted Directory

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...

BookStack code issue vulnerability

BookStack is an open-source platform for building wiki documents using PHP and Laravel from the BookStackApp Bookstackapp team.BookStack is vulnerable to a code issue that stems from a lack of file type restrictions in the software's controller.php, which could be exploited by an attacker to...

CVE-2021-41675

A Remote Code Execution RCE vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei...

CVE-2021-41675: Unrestricted Upload of File with Dangerous Type

A Remote Code Execution RCE vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei...

CVE-2021-40191: Improper Neutralization of Input During Web Page Generation

Dzzoffice Version 2.02.1 is affected by cross-site scripting XSS due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type of output data in webroot/dzz/attach/controller.php...

Cross site scripting

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...

CVE-2020-23370: Improper Neutralization of Input During Web Page Generation

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...

OpenEMR Remote Code Execution Vulnerability (CNVD-2021-05463)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A remote code execution vulnerability exists in OpenEMR 5.0.1. An attacker can exploit this vulnerability to upload and execute malicious PHP scripts via /controller.php...

CVE-2020-19364

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php...

Design/Logic Flaw

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php...

CVE-2020-19364

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php...

OpenEMR 代码问题漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A remote code execution vulnerability exists in OpenEMR 5.0.1. An attacker can exploit this vulnerability to upload and execute malicious PHP scripts via /controller.php...

CVE-2020-19364: Unrestricted Upload of File with Dangerous Type

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php...

CVE-2020-14043: Cross-Site Request Forgery (CSRF)

PRODUCT NOT SUPPORTED WHEN ASSIGNED A Cross Side Request Forgery CSRF vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins...

CVE-2020-13405: Missing Authentication for Critical Function

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...