PT-2017-13833

Name of the Vulnerable Software and Affected Versions LAME versions 3.97 through 3.99.5 Description A stack-based buffer overflow issue exists in the unpack read samples function within the frontend/get audio.c file. This is a distinct issue from previously reported problems. Recommendations For...

SQL Injection Vulnerability in TinyShop Frontend Common.php Page

TinyShop is an e-commerce system online store system based on the Tiny framework, suitable for businesses and individuals to quickly build a personalized online store. A SQL injection vulnerability exists in the TinyShop frontend Common.php page. The vulnerability is due to the system failing to...

Catfish CMS v4.5.7 SQL Injection Vulnerability in Frontend

Catfish CMS is open source free PHP CMS web content management system. Catfish CMS v4.5.7 suffers from a SQL injection vulnerability in the frontend. An attacker can exploit this vulnerability to obtain sensitive database information...

Edusoho Online Learning Platform v8.0.16 SQL Injection Vulnerability in Frontend

Edusoho Online Learning Platform is a B2C independent online school system developed by Hangzhou Kuochi Network Technology Co. Edusoho Online Learning Platform v8.0.16 SQL injection vulnerability exists in the frontend. An attacker can use this vulnerability to obtain sensitive information from t...

SQL Injection Vulnerability in TinyShop Frontend ucenter.php Page

TinyShop is an e-commerce system online store system based on the Tiny framework, suitable for businesses and individuals to quickly build a personalized online store. A SQL injection vulnerability exists in the TinyShop frontend ucenter.php page. The vulnerability is due to the system failing to...

File Upload Vulnerability in BEESCMS

BEESCMS is an enterprise website management system based on PHP+Mysql architecture. BEESCMS V4.0R20160525 version /includes/init.php file variable override script there is a file upload vulnerability, the attacker uses the vulnerability to upload arbitrary files, so as to obtain the front-end...

Cross-Site Scripting (XSS)

forkcms has cross-site scripting XSS vulnerability. The vulnerability is possible because the value returned by the getAllComments function in Frontend/Modules/Blog/Engine/Model.php is not properly escaped, allowing a malicious user to inject and execute arbitrary web script...

SQL Injection Vulnerability in OrderController.class.php in ShopsN 2.0 Official Frontend

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of the open source online store full network system. ShopsN 2.0 official version of the front-end OrderController.class.php SQL injection...

CVE-2015-8351: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

SQL Injection Vulnerability in ShopsN v2.0 Frontend OrderGroupController.class.php File

ShopsN is a free e-commerce open source system. ShopsN v2.0 official version of the front-end OrderGroupController.class.php file SQL injection vulnerability. The vulnerability is due to the system failing to effectively filter user-submitted data. An attacker can exploit this vulnerability to...

PT-2017-7400

Name of the Vulnerable Software and Affected Versions Gwolle Guestbook plugin versions prior to 1.5.4 Description The issue allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to "frontend/captcha/ajaxresponse.php". This can also be leveraged to...

Etherpad Directory Traversal Vulnerability

Etherpad is the Etherpad Foundation's open source rich-text online collaboration software . frontend tests is one of the front-end test component . A directory traversal vulnerability exists in the node/hooks/express/tests.js file in versions of Etherpad frontend tests prior to 1.6.1. An attacker...

Arbitrary File Write Vulnerability in KODExplorer v4.06 Frontend

KodExplorer Kodo Cloud formerly Mango Cloud is a private cloud and online file management system based on Web technology developed by Shanghai Daimu Networks Co., Ltd. and is committed to providing users with secure and controllable, reliable and easy-to-use, highly scalable private cloud...

KODExplorer v4.06 Arbitrary File Read Vulnerability in Frontend

KodExplorer Kodo Cloud formerly Mango Cloud is a private cloud and online file management system based on Web technology developed by Shanghai Daimu Networks Co., Ltd. and is committed to providing users with secure and controllable, reliable and easy-to-use, highly scalable private cloud...

Directory traversal

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085

CVE-2015-4085 is a directory traversal vulnerability in Etherpad frontend tests (node/hooks/express/tests.js) affecting Etherpad frontend tests prior to version 1.6.1. Exploitation could allow an attacker to browse files, impacting confidentiality (Partial). The issue is documented across multipl...

SQL Injection Vulnerability in BuliderOrder Method in Frontend of ShopsN 2.0 Official Version

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of the open source online store full network system. A SQL injection vulnerability exists in the BuliderOrder method in the frontend of...

CVE-2015-4085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...