CVE-2020-12743

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

EUVD-2020-5031

Malware in sbrugna...

EUVD-2012-1246

Malware in sbrugna...

EUVD-2020-14499

Malware in sbrugna...

CVE-2020-21731

Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update.; An attacker can inject JavaScript code, and the webapplication stores the injected code...

Gazie Cross-Site Scripting Vulnerability

Gazie is a financial application based on PHP and MySQL. The program supports features such as invoice management, inventory management and order management. A cross-site scripting vulnerability exists in Gazie version 7.29, which originates from an improper validation of client-side data by...

CVE-2020-21731

Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...

CVE-2020-21731

Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...

Cross site scripting

Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...

CVE-2020-21731

Gazie 7.29 is affected by a stored Cross-Site Scripting (XSS) vulnerability. The issue occurs in the web app via the admin_utente.php?user_name=amministratore&Update parameter, where injected JavaScript code can be stored and later executed by users. This is a general XSS flaw described across mu...

CVE-2020-21731

Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...

Gazie File Inclusion Vulnerability

Gazie is a financial application based on PHP and MySQL. The program supports features such as invoice management, inventory management and order management. A security vulnerability exists in Gazie version 7.32. An attacker can exploit the vulnerability to include arbitrary PHP files with the he...

CVE-2020-12743

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

CVE-2020-12743

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

Authentication flaw

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

CVE-2020-12743

Gazie 7.32 contains an unauthenticated PHP file inclusion vulnerability in /setup/install/setup.php, which remains accessible after setup and can be requested via a hidden_req POST parameter. The issue enables arbitrary PHP file inclusion and is described with high impact (NVD CVSSv3.1: CRITICAL,...

CVE-2020-12743

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

GAzie 5.10 (Login parameter) Multiple Vulnerabilities

No description provided by source. GAzie 5.10 Login parameter Multiple Remote Vulnerabilities Vendor: Antonio de Vincentiis Product web page: http://www.devincentiis.it, http://gazie.sourceforge.net Affected version: 5.10 Summary: GAzie is a multi-company management program ERP that runs on Apach...

CVE-2012-1220

Cross-site request forgery CSRF vulnerability in modules/config/adminutente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in modules/config/adminutente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password...