CVE-2014-125090 Media Downloader Plugin getfile.php dl_file_resumable cross site scripting

A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dlfileresumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

CVE-2014-125090: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dlfileresumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotel...

PrestaShop Path Traversal Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A path traversal vulnerability exists in PrestaShop Olea Gift versions prior to 5.0.8...

CVE-2020-9368: Improper Limitation of a Pathname to a Restricted Directory

The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199: Improper Limitation of a Pathname to a Restricted Directory

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

rotary2240.org XSS vulnerability

Open Bug Bounty ID: OBB-450764 Description| Value ---|--- Affected Website:| rotary2240.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2014-8801: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the QUERYSTRING in a getfile action to wp-admin/admin-ajax.php...

WordPress Plugin Paid Memberships Pro 1.7.14.2 - Directory Traversal

WordPress Plugin Paid Memberships Pro 1.7.14.2 - Directory Traversal Exploit Title: Paid Memberships Pro 1.7.14.2 Path Traversal Date: 14-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.14.2.zip...

WordPress Plugin Paid Memberships Pro 1.7.14.2 - Directory Traversal

Exploit Title: Paid Memberships Pro 1.7.14.2 Path Traversal Date: 14-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.14.2.zip Category: webapps CVE: CVE-2014-8801 1. Description getfile.php is...

Dev Web Management System 1.5 getfile.php cat Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/16063/info Dev Web Management System is prone to multiple input validation vulnerabilities. These issues may allow SQL injection and cross-site scripting attacks. Dev Web Management System versions 1.5 and earlier are pro...

CVE-2008-0918: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/countdlorlink.inc.php in the astatsPRO comastatspro 1.0.1 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to getfile.php, a different vector than CVE-2008-0839. NOTE: the provenance of this information is...

Dev_15_sql_xpl.php.txt

---- Dev web management system ConfLoadDBtoPHP; include "admin/config.php"; echo "...

CVE-2005-4554: Undefined Security Weakness

Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter in an openforum action openforum.php in index.php, 2 cat parameter in getfile.php, and 3 target parameter in downloadnow.php...