697 matches found
CVE-2024-33445
An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugins.php component...
Jfinalcms 安全漏洞
JFinalCMS is a content management system by heyewei individual developer. A security vulnerability exists in Jfinalcms version v.5.0.0, which stems from the presence of a cross-site scripting vulnerability that allows remote attackers to execute arbitrary code via a crafted script...
CVE-2024-31621
CVE-2024-31621 affects Flowise Flowise v1.6.2 and earlier, with multiple sources describing an authentication bypass (notably in Flowise = 1.6.6 / 1.8.1+ per other reports). If exploitation details are present, they confirm remote code execution via /api/v1; otherwise, exploitation specifics are ...
CVE-2024-33443
An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component...
CVE-2024-33444
SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component...
CVE-2024-33444
SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component...
CVE-2024-31621
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...
CVE-2024-31621
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...
CVE-2024-33443
The CVE-2024-33443 entry concerns onethink v1.1, where a crafted script to AddonsController.class.php enables remote arbitrary code execution. The issue is exposed over the network with low privileges and no user interaction. The available connected sources describe the vulnerable component as Ad...
CVE-2023-51254
Jfinalcms 5.0.0 is affected by a Cross Site Scripting (XSS) flaw in the friendship link component. The weakness stems from inadequate input validation, allowing a remote attacker to inject script and potentially execute arbitrary code. Documented by multiple sources (Veracode, CNNVD, OSV, Red Hat...
CVE-2024-31621
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...
CVE-2024-32358
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...
CVE-2024-32358
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...
CVE-2024-32358
CVE-2024-32358 affects JPress v5.1.0. The issue allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, indicating a code execution risk originating from the plug‑in handling path. No remediation patch/version details are provided in the supp...
CVE-2024-32358
An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...
CVE-2024-31666
An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the editaddonpost.php component...
CVE-2024-31666
CVE-2024-31666 affects flusity-CMS v2.33. The vulnerability allows a remote attacker to execute arbitrary code via a crafted script targeting the edit_addon_post.php component. Multiple connected sources (NVD, Red Hat, OSV, CVE listing, CNNVD, and vuln enrichment) describe the same issue, confirm...
CVE-2024-32409
An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script...