newbee-mall 代码问题漏洞

newbee-mall is an e-commerce system. newbee-mall v1.0.0 has a security vulnerability that can be exploited by attackers to upload arbitrary files via the upload function of /admin/goods/edit...

PT-2021-17128 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 4.0 Description: The issue allows remote attackers to execute arbitrary SQL statements. This is achieved via the id parameter to the "edit-std.php" endpoint. Recommendations: For PHPGurukul Student...

Sentrifugo SQL Injection Vulnerability (CNVD-2020-66084)

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. Sentrifugo version 3.2 suffers from a SQL injection vulnerability that originates from the fact that administrators c...

Monstra Access Control Error Vulnerability

Monstra is a lightweight content management system CMS. An access control error vulnerability exists in Monstra 3.0.4 and earlier versions. A remote attacker can exploit this vulnerability to take over arbitrary user accounts via the modified login parameter of the edit URI...

PT-2019-7755 · WordPress · Icegram

Name of the Vulnerable Software and Affected Versions: icegram plugin versions prior to 1.9.19 Description: The issue concerns a CSRF vulnerability via the option name parameter in the "wp-admin/edit.php" endpoint. This allows for potential unauthorized actions. Recommendations: For versions prio...

CVE-2019-8407

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...

PT-2018-15154 · Xslt · Xslt Cms

Name of the Vulnerable Software and Affected Versions: XSLT CMS affected versions not specified Description: A persistent XSS issue exists in XSLT CMS, allowing exploitation via the "body" field in the create/?action=items.edit&type=Page endpoint. Recommendations: At the moment, there is no...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2018-19424)

LavaLite is an open source lightweight CMS content management system. A cross-site scripting vulnerability exists in LavaLite version 5.5. A remote attacker can use the /edit URI to inject arbitrary Web script or HTML...

PT-2018-13098 · Reprise · Reprise License Manager

Name of the Vulnerable Software and Affected Versions: Reprise License Manager versions through 12.2BL2 Description: An issue was discovered in the Reprise License Manager, where attackers can use the web interface to read and write data to any file on disk, as long as rlm.exe has access to it, v...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-08697)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability by sending the 'appid' parameter to the zbusers/plugin/AppCentre/pluginedit.php file to...