Tenda AC18 security vulnerabilities

Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in July 2016, mainly for villas and large home users, supporting 2.4GHz and 5GHz dual-band, with a maximum transmission rate of 1900Mbps. Tenda AC18 suffers from a stack buffer overflow vulnerability that...

CVE-2022-47532

FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request...

CVE-2022-47532

FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request...

PT-2023-15390 · Filerun · Filerun

Name of the Vulnerable Software and Affected Versions: FileRun version 20220519 Description: The issue allows SQL Injection via the dir parameter in a "/?module=users&section=cpanel&page=list" API endpoint. This could potentially lead to unauthorized access to sensitive data. Recommendations: For...

CVE-2022-47532: Improper Neutralization of Special Elements used in an SQL Command

FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request...

CVE-2022-47532

FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request...

Nagios XI graphtemplates.php Code Execution

The vulnerability in the graphtemplates.php script of the Nagios XI monitoring tool is related to errors in information representation by the user interface when processing the dir parameter. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, or delete data, or...

PT-2023-7761 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the graphtemplates.php script in Nagios XI, which is vulnerable due to errors in handling the dir parameter. This can allow a remote attacker to read, modify, or...

CVE-2023-37703

Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the speeddir parameter in the formSetSpeedWan function...

PT-2023-11588 · Unknown · Nucleus Cms

Name of the Vulnerable Software and Affected Versions: NucleusCMS version 3.71 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the "https://example.com/nucleus/plugins/skinfiles/?dir=rsd" API endpoint, where the dir parameter is set to rsd...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

PT-2023-25044 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: Ujcms version 6.0.2 Description: An issue in Ujcms allows attackers to gain sensitive information via the dir parameter to the "/api/backend/core/web-file-html/download-zip" API endpoint. Recommendations: For Ujcms version 6.0.2, as a tempora...

CVE-2023-34878: Observable Discrepancy

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

UJCMS security vulnerabilities

UJCMS is UJCMS open source a Java open source content management system . A security vulnerability exists in UJCMS v6.0.2. An attacker exploited the vulnerability to obtain sensitive information via the dir parameter of /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-34878

An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip...

CVE-2023-2117

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...

CVE-2023-2117

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...

CVE-2023-2117

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...