RP_Import_RCE

Real Player 'external::Import' Arbitrary file download, Directory Traversal Vulnerabilities leads to Remote Code Execution video demo: https://youtu.be/CONlijEgDLc Real Player uses Microsoft Internet Explorer functionality and exposes properties and methods through a special mean which is...

SUSE CVE-2026-54061

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send...

CVE-2022-32270

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

RealNetworks Real Player 路径遍历漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a wide variety of online audio and video material. A security vulnerability exists in Real Player versions 20.0.7.309 and 20.0.8.310, which stems from external::Import allows downloading of arbitrary file typ...

PT-2022-21195

Name of the Vulnerable Software and Affected Versions Real Player versions 20.0.7.309 through 20.0.8.310 Description The issue allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup...

CVE-2022-32270: Improper Limitation of a Pathname to a Restricted Directory

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

Automattic: Reflected XSS on a Atavist theme at external_import.php

Summary: Hi team, I found this php file https://magazine.atavist.com/static/externalimport.php , and there is a parameter called scripts on this php file. Basically, the endpoint prints value of scripts parameter to . So we can import any script file like that :...

CVE-2017-18033: Cross-Site Request Forgery (CSRF)

The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery CSRF vulnerabilities...