CVE-2024-37622

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the num parameter at /flow/flow.php...

CVE-2024-37622

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the num parameter at /flow/flow.php...

CVE-2024-37622: Improper Neutralization of Input During Web Page Generation

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the num parameter at /flow/flow.php...

CVE-2024-37622

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the num parameter at /flow/flow.php...

CVE-2024-34193: Improper Limitation of a Pathname to a Restricted Directory

smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading...

Smanga 安全漏洞

Smanga is a docker direct-installed manga streaming reading tool by the individual developer lkw199711. A security vulnerability exists in Smanga version 3.2.7, which stems from a path traversal vulnerability in the flow.php interface due to a lack of filtering on the file parameter, which can le...

ECShop SQL Injection Vulnerability (CNVD-2021-44947)

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 2.7.6. An attacker can exploit this vulnerability by using the goodsnumber parameter of flow.php to conduct a SQL injection attack...

CVE-2020-22204

SQL Injection in ECShop 2.7.6 via the goodsnumber parameter to flow.php...

Sql injection

SQL Injection in ECShop 2.7.6 via the goodsnumber parameter to flow.php...

CVE-2020-22204

CVE-2020-22204 describes a SQL injection vulnerability in ECShop 2.7.6 exploitable via the goods_number parameter of flow.php. The included connected sources (CNVD/CNNVD/NVD entries) confirm ECShop 2.7.6 is affected and that the injection occurs through a poorly sanitized goods_number parameter. ...

PT-2021-10747

Name of the Vulnerable Software and Affected Versions ECShop version 2.7.6 Description The issue is related to SQL Injection via the goods number parameter to the "flow.php" endpoint. This allows for potential exploitation. Recommendations For ECShop version 2.7.6, avoid using the goods number...

CVE-2020-22204: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in ECShop 2.7.6 via the goodsnumber parameter to flow.php...

ECShop SQL注入漏洞

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 2.7.6. An attacker can exploit this vulnerability by using the goodsnumber parameter of flow.php to conduct a SQL injection attack...

ecshop 2.7.3 /flow.php 登录绕过漏洞

影响文件:flow.php 188行开始elseif $REQUEST'step' == 'login' includeonce'languages/'. $CFG'lang'. '/user.php'; / 用户登录注册 / if $SERVER'REQUESTMETHOD' == 'GET' ..... else includeonce'includes/libpassport.php'; if !empty$POST'act' && $POST'act' == 'signin' $captcha = intval$CFG'captcha'; if $captcha &...

ECShop 2.7.3 flow.php SQL注入漏洞

No description provided by source...

ecshop 2.7.2 flow.php sql注入漏洞

No description provided by source...

ECShop 2.7.2 红包注入漏洞

简要描述： flow.php页面看似intval的红包ID，其实可以注入。以下文章仅从代码推测，并未进行测试，不过这太明显了，就不测试了，各位看官测试失败请跟帖骂娘，死亡节奏技术小组、恶灵战队路过。 详细说明： /flow.php 1168行开始 $bonus = bonusinfointval$GET'bonus'; if !empty$bonus && $bonus'userid' == $SESSION'userid' || $GET'bonus' == 0 $order'bonusid' = $GET'bonus'; else $order'bonusid' = 0;...