PT-2023-27655 · Perfree · Perfreeblog

Name of the Vulnerable Software and Affected Versions: Perfree PerfreeBlog version 3.1.2 Description: An issue in Perfree PerfreeBlog allows a remote attacker to execute arbitrary code via a crafted plugin listed in "admin/plugin/access/list". Recommendations: For Perfree PerfreeBlog version 3.1....

CVE-2023-40825

An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list...

CVE-2023-38948

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin...

Arbitrary file deletion

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin...

CVE-2023-38948

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin...

Uptime Kuma 输入验证错误漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. An input validation error vulnerability exists in versions prior to Uptime Kuma 1.22.1, which stems from allowing an authenticated attacker to install a maliciously crafted plugin, which could lead...

SUSE CVE-2017-7178

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves 1 hosting a crafted plugin that executes an arbitrary program from its init.py file and 2 causing the victim to download, install, and enable this plugin...

Multi-image Analysis GUI 安全漏洞

Multi-image Analysis GUI Mango is a viewer of medical research images organized by the University of Texas Health Science Center. A security vulnerability in University of Texas Health Science Center Multi-image Analysis GUI version 4.1, which stems from an issue in RoamingMangoPlugins allows...

GHSA-5469-C5P2-XV5G Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem...

CVE-2022-34113

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...

Design/Logic Flaw

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...

CVE-2022-34113

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...

CVE-2022-34113

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...

CVE-2022-29710

A cross-site scripting XSS vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin...

CVE-2022-29710

A cross-site scripting XSS vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin...

CVE-2022-29710

A cross-site scripting XSS vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin...

PT-2022-19793 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 5.3.9 and below Description: A cross-site scripting XSS issue in the uploadConfirm.php file allows attackers to execute arbitrary web scripts or HTML via a crafted plugin. This can be exploited by attackers to execute...

Cross site scripting

An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code if CSP allows it in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed...

CVE-2021-38745

Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page...

CVE-2021-38745

Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page...