Design/Logic Flaw

PKP-WAL aka PKP Web Application Library or pkp-lib before 3.3.0-16, as used in Open Journal Systems OJS and other products, does not verify that the file named in an XML document used for the native import/export plugin is an image file, before trying to use it for an issue cover image...

PT-2023-10324 · Unknown · Saat Netizen +1

Name of the Vulnerable Software and Affected Versions: SaAT Netizen installer versions 1.2.0.424 and earlier SaAT Netizen versions 1.2.0.8 and earlier Description: The issue allows a remote unauthenticated attacker to conduct a man-in-the-middle attack due to improper file verification. A...

CVE-2023-45799

In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files...

Input validation

In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files...

CVE-2023-45799

MLSoft TCO!stream ≤8.0.22.1115 is affected by a vulnerability due to insufficient permission validation, enabling an attacker to cause the victim to download and execute arbitrary files. The connected documents consistently identify the affected product/versions and the core cause but do not prov...

PT-2023-29313 · WordPress · Dropbox Folder Share

Name of the Vulnerable Software and Affected Versions: Dropbox Folder Share for WordPress versions up to, and including, 1.9.7 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the editor-view.php file. This enables the execution of a...

Design/Logic Flaw

web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...

Yii Path Traversal Vulnerability

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii before version 2.0.5, which can be exploited to execute any local .php file via webViewAction...

CVE-2015-5467

web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...

CVE-2015-5467

web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...

The vulnerability of the Redmine project and task management web application, related to improper handling of exceptional states, allows a hacker to upload and execute any file they desire.

The vulnerability of the Redmine project and task management web application lies in the improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to remotely upload and execute any file they desire...

CVE-2023-2453

CVE-2023-2453 affects PHPFusion. The issue is insufficient sanitization of tainted file names directly concatenated with a path and passed to a require_once statement, allowing inclusion and execution of arbitrary .php files when the absolute path is known. The description notes there is no known...

CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

PHPFusion Security Vulnerability

PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion that stems from inadequate cleanup of tainted filenames, allowing the...

JVN#92720882: Multiple vulnerabilities in CGIs of PMailServer and PMailServer2

CGIs included with PMailServer and PMailServer2 provided by A.K.I Software contain multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-39223 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVS...

CVE-2023-36281

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to loadprompt. This is related to subclasses or a template...

CVE-2023-31448

A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths,...

Command injection

A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerabili...

CVE-2023-31448

CVE-2023-31448 affects Paessler PRTG Network Monitor: the HL7 sensor in version 23.2.84.1566 and earlier allows an authenticated user with write privileges to manipulate HL7 input and cause path traversal, enabling execution of files outside the designated custom sensors folder. This results in p...

CVE-2023-31450

A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the SQL v2 sensors into behaving differently for existing files and non-existing files. This made it possible to traverse...