PT-2023-26327 · Unknown · Superwebmailer

Name of the Vulnerable Software and Affected Versions: SuperWebMailer version 9.00.0.01710 Description: An issue was discovered in SuperWebMailer that allows spamtest external.php XSS via a crafted filename. The issue is related to the filename variable, which can be exploited to execute XSS...

SQL Injection

moodle/moodle is vulnerable to SQL Injection attacks. The vulnerability exists in getsubwikipages function of external.php due to lack of sanitization of user inputs which allows an attacker to inject and execute arbitrary sql queries...

CVE-2022-28353: Improper Neutralization of Input During Web Page Generation

In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL aka external.php?url= is vulnerable to XSS...

Information Disclosure

moodle/moodle is vulnerable to information disclosure. The vulnerability exists through the attempts parameter inexternal.php due to improper access control which allows an authenticated attacker to gain access to confidential information in the file system via insufficient capability checks...

CVE-2019-17646

An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreonmetric&action=listByService...

PT-2020-9937

Name of the Vulnerable Software and Affected Versions Centreon versions prior to 18.10.8 Centreon versions prior to 19.04.5 Centreon versions prior to 19.10.2 Description An issue was discovered that provides sensitive information via an unauthenticated direct request for the...

CVE-2019-17646: Direct Request

An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreonmetric&action=listByService...

CVE-2014-4550: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter...

my.ryte.com Open Redirect vulnerability

Vulnerable URL: https://my.ryte.com/utils/goto-external.php?https%3A%2F%2Fwww.openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.11.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

thecovernippon.jp Open Redirect vulnerability

Vulnerable URL: http://www.thecovernippon.jp/external.php?exurl=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 3517486 Google Pagerank| 0 VIP...

PT-2014-8298

Name of the Vulnerable Software and Affected Versions Moodle versions 2.7.x through 2.7.2 Description The issue allows remote authenticated users to obtain sensitive information by accessing the get grades web service, leveraging the student role. This occurs because the lib/classes/grades...

PT-2014-5964

Name of the Vulnerable Software and Affected Versions OMFG Mobile Pro plugin versions 1.1.26 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is exploited via the...

CVE-2014-4541: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter...

PT-2014-2830

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2 Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for...

Moodle 'external.php' 'badge' Parameter XSS

The version of Moodle installed on the remote host fails to properly sanitize user-supplied input to the 'badge' parameter of the 'external.php' script. The application also fails to properly sanitize serialized objects. An attacker can exploit these issues by crafting a URL containing a serializ...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

PT-2013-5721

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.x through 2.5.1 Description The issue allows remote attackers to conduct PHP object injection attacks. This is due to improper handling of an object obtained by unserializing a description of an external badge in the...

CVE-2013-5674: Improper Control of Generation of Code

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2010-0975: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PHP code via a URL in the url parameter...