17 matches found
EUVD-2020-13754
Malware in sbrugna...
CVE-2018-18488
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...
Sql injection
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter...
CVE-2020-20975
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter...
CVE-2020-20975: Improper Neutralization of Special Elements used in an SQL Command
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter...
PT-2021-10563
Name of the Vulnerable Software and Affected Versions: Gxlcms version 1.1 Description: SQL Injection exists in the dataaction.class.php file via the $filename parameter. This issue allows for potential SQL injection attacks. Recommendations: For Gxlcms version 1.1, avoid using the $filename...
Path traversal
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component...
CVE-2020-17564: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component...
PT-2021-10107
Name of the Vulnerable Software and Affected Versions: FeiFeiCMS version 4.0 Description: The issue allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the "Admin/DataAction.class.php" component. This is a result of a Path Traversal weakness. Recommendations: Fo...
CVE-2018-18488
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...
Sql injection
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...
CVE-2018-18488
Gxlcms v2.0 is affected by a SQL injection in the file \lib\admin\action\dataaction.class.php via the ids[] parameter. Connected sources (NVD, RH, CNVD) describe remote exploitation with arbitrary SQL execution, with network access and no authentication required (per CVSS 3.0/2.0 vectors). No con...
CVE-2018-18487: Exposure of Sensitive Information to an Unauthorized Actor
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mtrand unsafely, resulting in predictable database backup file locations...
CVE-2018-18488: Improper Neutralization of Special Elements used in an SQL Command
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...
CVE-2018-9850: Improper Limitation of a Pathname to a Restricted Directory
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...
PT-2018-18929
Name of the Vulnerable Software and Affected Versions Gxlcms QY version 1.0.0713 Description The issue allows remote attackers to execute arbitrary SQL statements via the sql parameter in the upsql function. This can lead to the execution of arbitrary PHP code by placing it after a ?php substring...
CVE-2018-9247: Improper Neutralization of Special Elements used in an SQL Command
The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a...