859 matches found
CVE-2020-20444
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...
Security feature bypass
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...
PT-2021-3440 · Jact · Openclinic
Name of the Vulnerable Software and Affected Versions: Jact OpenClinic version 0.8.20160412 Description: The issue is related to errors in authorization in the shared/view source.php component of the OpenClinic software for managing medical records. An attacker, acting remotely, can exploit this...
Jact OpenClinic 安全漏洞
OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in Jact OpenClinic version 0.8.20160412, which could lead to an RCE vulnerability if an attacker logs in...
CVE-2021-31783
showdefault.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check...
LocalFilesEditor 数据伪造问题漏洞
LocalFilesEditor is a software application. Photobooth software for the web, built by an active community of users and developers. A security vulnerability exists in the LocalFilesEditor extension prior to version 11.4.0.1, which stems from a file parameter not being validated by proper regular...
CVE-2021-28417
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "searchname" parameter...
Local File Inclusion
Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Local File Inclusion. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class...
PT-2021-11898 · Unknown · Seat Reservation System
Name of the Vulnerable Software and Affected Versions: Seat-Reservation-System version 1.0 Description: The issue is related to a SQL injection vulnerability in the index.php file, specifically affecting the id and file parameters. This allows attackers to obtain sensitive database information...
PT-2021-2306 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to a Reflected Cross-site Scripting vulnerability via the file parameter. Successful exploitation...
CVE-2020-19360
Affected software: FHEM 6.0. Vulnerability: Local File Inclusion via the fhem/FileLog_logWrapper parameter, per multiple sources (NVD/Nuclei/RH/CNVD). Impact: potential sensitive information disclosure by reading arbitrary files on the target. Technical details: documented as LFI; CVSS3.1 score 7...
CVE-2020-19360
Local file inclusion in FHEM 6.0 allows in fhem/FileLoglogWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure...
CVE-2021-23835
CVE-2021-23835 affects flatCore prior to 2.0.0 build 139. The issue is a local file disclosure in the docs_file HTTP request body parameter of the acp interface, which accepts malicious user input and can reveal sensitive backend files (e.g., /etc/passwd, SQLite DBs, PHP source) when an attacker ...
CVE-2021-3029
EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer...
CVE-2021-3029
EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer...
PT-2021-18698 · Evolucare · Evolucare Ecsimaging
Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions 6.21.5 and earlier Description: The issue is related to an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The file parameter on the webpage "/showfile.php" ca...
VulnCheck KEV: CVE-2015-2067
Directory traversal vulnerability in web/ajaxpluginconf.php in the MAGMI aka Magento Mass Importer plugin for Magento Server allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...
VulnCheck KEV: CVE-2008-4873
board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...
Piwigo 2.10.1 Cross Site Scripting
Exploit Title: Piwigo 2.10.1 - Cross Site Scripting POC by: Iridium Software Homepage: http://www.piwigo.org Version : 2.10.1 Tested on: Linux & Windows Category: webapps Google Dork: intext: "Powered by Piwigo" CVE : CVE-2020-9467 Description Piwigo 2.10.1 has stored XSS via the file parameter i...