30 matches found
CVE-2026-19985: Improper Neutralization of Input During Web Page Generation
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...
Atom CMS v2.0 - Cross-Site Scripting Detection
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the "A" parameter in /widgets/debug.php. !/usr/bin/env python3 -- coding: utf-8 -- """Atom CMS v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
User Meta WP Plugin < 3.1 - Sensitive Information Exposure Detection
The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. !/usr/bin/env python3 -- coding: utf-8 -- """The User Meta is...
EUVD-2022-30158
Malicious code in bioql PyPI...
Atom CMS Cross-Site Scripting Vulnerability (CNVD-2022-84074)
Atom CMS, a content management system, is vulnerable to a cross-site scripting vulnerability in Atom CMS v2.0. The vulnerability is caused by a cross-site scripting vulnerability that contains a reflection in the "A" parameter in /widgets/debug.php. An attacker could exploit this vulnerability to...
CVE-2022-25489
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the "A" parameter in /widgets/debug.php...
Cross site scripting
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the "A" parameter in /widgets/debug.php...
CVE-2022-25489
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the "A" parameter in /widgets/debug.php...
CVE-2022-25489: Improper Neutralization of Input During Web Page Generation
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the "A" parameter in /widgets/debug.php...
PT-2022-17324
Name of the Vulnerable Software and Affected Versions Atom CMS version 2.0 Description A reflected cross-site scripting XSS issue was found in Atom CMS. The issue is related to the A parameter in the "/widgets/debug.php" API endpoint. This allows for potential XSS attacks. Recommendations For Ato...
PT-2021-17995
Name of the Vulnerable Software and Affected Versions: MagpieRSS version 0.72 Description: The issue arises from a lack of validation on a curl command in the /extlib/Snoopy.class.inc file. This allows an attacker to request any internal page when sending a request to the /scripts/magpie debug.ph...
Path traversal
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...
CVE-2019-18871
The vulnerability CVE-2019-18871 affects Blaauw Remote Kiln Control (v3.00r4) and is a path-traversal flaw in debug.php accessed via default.php. An authenticated attacker can upload arbitrary files, enabling arbitrary remote code execution. Multiple connected sources (Red Hat, CNVD, NVD, CVE lis...
PT-2020-10002
Name of the Vulnerable Software and Affected Versions Blaauw Remote Kiln Control versions through v3.00r4 Description A path traversal issue in debug.php, accessed via default.php, allows an authenticated attacker to upload arbitrary files. This can lead to arbitrary remote code execution...
CVE-2019-18871: Improper Limitation of a Pathname to a Restricted Directory
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...
PT-2019-7120
Name of the Vulnerable Software and Affected Versions WP-Planet plugin versions 0.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the url parameter in the...
CVE-2018-11031
PHPRAP 1.0.4–1.0.8 is affected by a server-side request forgery (SSRF) in the file application/home/controller/debug.php, exploitable via the /debug URI. The issue is triggered by crafted input such as api[url]=file:////etc/passwd and api[method]=get in a POST request, enabling an attacker to ind...
CVE-2018-11031: Server-Side Request Forgery (SSRF)
application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an apiurl=file:////etc/passwd&apimethod=get POST request...
Webfwlog <= 0.92 (debug.php) Remote File Disclosure Vulnerability
No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + D.Script:ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/webfwlog-0.92.tbz + D.Scrpit:http://webfwlog.sourceforge.net/...