31 matches found
CVE-2026-89013
CVE-2026-89013 — Dolibarr hashp=shared 授权绕过 针对 CVE-2026-89013 的漏洞利用：当存在 hashp 参数时，document.php 和 viewimage.php 会强制 NOLOGIN。内部标记值 shared 会跳过共享令牌解析，但访问控制覆盖仍会对任何非空值生效，并设置 $accessallowed = 1，从而丢弃 dolchecksecureaccessdocument 的结果。因此，未经身份验证的请求可以读取每个 modulepart 树中的任意文件：业务文档、管理员日志、SQL...
CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...
CVE-2026-89013
Dolibarr (ERP/CRM) versions 23.0.4 before 24.0.1 contains an authorization bypass in its document storage endpoints (htdocs/document.php and htdocs/viewimage.php). By sending a request with the crafted parameter hashp=shared , an unauthenticated attacker can skip token validation while still sati...
EUVD-2020-23651
Malware in sbrugna...
EUVD-2020-10379
Malware in sbrugna...
EUVD-2022-4732
Malicious code in bioql PyPI...
CVE-2024-30920
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...
CVE-2020-18455
Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...
CVE-2024-30920
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...
CVE-2024-30920
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...
CVE-2024-30920
CVE-2024-30920 is a Cross Site Scripting (XSS) vulnerability in DerbyNet v9.0 and earlier, enabling a remote attacker to execute arbitrary code via the render-document.php component. The root cause cited is improper sanitization of user input in document rendering paths (exposure of debug informa...
CVE-2020-36073
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page...
CVE-2020-36073
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page...
CVE-2020-18455
Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...
Cross site scripting
Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...
CVE-2020-18455
CVE-2020-18455 affects bycms v3.0.4, with an XSS vulnerability in the edit(Document.php) function via the title parameter. The connected sources confirm the vulnerable component and entry details; no patch/version remediation information is provided in the supplied documents. Exploitation details...
CVE-2020-18455
Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...
bycms 跨站脚本漏洞
bycms is a simple, easy-to-use content management system. A cross-site scripting vulnerability exists in bycms v3.0.4, which originates from the title parameter in the edit function in Document.php...
cpCommerce v1.2.8 - (id_document) Blind SQL Injection
Document Title: =============== cpCommerce v1.2.8 - iddocument Blind SQL Injection References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2254 Release Date: ============= 2020-05-08 Vulnerability Laboratory ID VL-ID: ==================================== 2254...