CVE-2021-44127: Undefined Security Weakness

In DLink DAP-1360 F1 firmware version =v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized...

PT-2022-12000

Name of the Vulnerable Software and Affected Versions DLink DAP-1360 F1 versions =v6.10 Description The issue allows an attacker to execute arbitrary system commands using the file parameter when it is set to name=deleteFile after authorization. This is related to the "webupg" binary...

Remote code execution

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

BloofoxCms 跨站脚本漏洞

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

CVE-2021-44608

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

PT-2022-12185

Name of the Vulnerable Software and Affected Versions bloofoxCMS versions 0.5.1 through 0.5.2.1 Description Multiple Cross Site Scripting XSS vulnerabilities exist in the software. The issue is related to the file parameter and the type parameter in an edit action in the "index.php" endpoint...

CVE-2021-44608: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...

GHSA-673J-QM5F-XPV8 pgjdbc Arbitrary File Write Vulnerability

Overview The connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows...

CVE-2021-46427

An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php...

CVE-2022-22851

A Stored Cross Site Scripting XSS vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php...

PT-2022-11963

Name of the Vulnerable Software and Affected Versions SysAid ITIL version 20.4.74 b10 Description The issue allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body to the "/UploadPsIcon.jsp" API endpoint. A successful request returns the...

CVE-2021-43973: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file...

Directory traversal

Specially-crafted command line arguments can lead to arbitrary file deletion. The handledelete function does not attempt to sanitize or otherwise validate the contents of the file parameter passed to the function as argv1, allowing an authenticated attacker to supply directory traversal primitive...

Cross site scripting

The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the /h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-39318 H5P CSS Editor <= 1.0 Reflected Cross-Site Scripting

The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the /h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-39433

A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user...

PT-2021-22585

Name of the Vulnerable Software and Affected Versions: BIQS IT Biqs-drive versions 1.83 and below Description: A local file inclusion LFI issue exists when sending a specific payload as the file parameter to the "download/index.php" endpoint. This allows an attacker to read arbitrary files from t...

CVE-2021-38334 WP Design Maps & Places <= 1.2 Reflected Cross-Site Scripting

The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...