18 matches found
CVE-2026-62383
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...
PT-2026-66886
Name of the Vulnerable Software and Affected Versions nltk versions prior to 3.9.5 Description A path-traversal issue in NKJPCorpusReader allows an attacker to read files outside the designated corpus root by influencing the fileids argument. This occurs because the reader uses plain string...
EUVD-2019-9334
Malware in sbrugna...
EUVD-2019-9335
Malware in sbrugna...
CVE-2019-19734
accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...
CVE-2019-19733
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
CVE-2015-9292
6kbbs 7.1 and 8.0 allows CSRF via portalchannelajax.php id or code parameter or admin.php fileids parameter...
PT-2020-12701
Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke version 9.5 Description The issue allows a registered user to disclose information about files in the Admin File Manager by sending a message with an attached file. This is achieved by using an arbitrary small integer...
CVE-2020-11585: Use of Insufficiently Random Values
There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...
CVE-2019-19733
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
Sql injection
accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...
Design/Logic Flaw
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
PT-2019-15934
Name of the Vulnerable Software and Affected Versions YetiShare version 3.5.2 Description The issue allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database. This is due to the direct insertion of values from the fileIds parameter into a SQL...
PT-2019-15933
Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.3 Description The issue allows an attacker to input HTML or execute scripts on the site due to the lack of sanitization or encoding of the output from the fileIds parameter in the get all file...
CVE-2019-19734: Improper Neutralization of Special Elements used in an SQL Command
accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...
CVE-2019-19733: Improper Neutralization of Input During Web Page Generation
getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...
PT-2019-7251
Name of the Vulnerable Software and Affected Versions 6kbbs versions 7.1 through 8.0 Description The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with id or code parameters, and "admin.php" with a fileids parameter. Recommendations For versions 7.1...