CVE-2020-18114

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

Design/Logic Flaw

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

CVE-2020-18114

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

CVE-2020-18114

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

CVE-2020-18114

CVE-2020-18114 affects DedeCMS V5.7SP2, with an arbitrary file upload vulnerability in the /uploads/dede component that allows uploading a webshell in HTM format. This enables remote code execution via a crafted HTM upload, per the description in the CVE entry. Connected sources corroborate the s...

CVE-2021-34223

Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 Important Update, new UI allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field...

CVE-2021-34215

Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 Important Update, new UI allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-18013

SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?adminbanned/add.htm...

SourceCodester E-Commerce Website Cross-Site Scripting Vulnerability

SourceCodester E-Commerce Website is an application. A PHP e-commerce website project for bookstores. SourceCodester E-Commerce Website v 1.0 is vulnerable to a cross-site scripting vulnerability that could be exploited to inject arbitrary web script or HTM into feedbackprocess.php via the subjec...

CVE-2020-23574

Sysax Multi Server 6.90 is affected. An authenticated user can modify the filename="" parameter in the uploadfile_name1.htm upload form to reach 368+ bytes, triggering a buffer overflow that causes the application to crash. Root cause is a overflow in handling long filenames during file upload. N...

CVE-2020-23574: Improper Restriction of Operations within the Bounds of a Memory Buffer

When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfilename1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition, causing the application to crash...

SQL injection vulnerability in do***.htm page of cross-border e-commerce integrated platform of Shenzhen Hualei Logistics Information Technology Co.

Ltd. is an information technology service provider. Ltd. cross-border e-commerce integrated platform do.htm page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in Co***.htm Page of Home Furnishing ERP Management System of Shanghai Furnishing Union Information Technology Co.

Ltd. is a software service company specializing in enterprise management solutions for the decoration industry. Ltd. home decoration ERP management system Co.htm page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

CVE-2020-8798

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

CVE-2020-8798

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

Design/Logic Flaw

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

PT-2020-20287

Name of the Vulnerable Software and Affected Versions Juplink RX4-1500 versions 1.0.3 through 1.0.5 Description The issue allows remote attackers to change or access router settings by connecting to the unauthenticated "setup3.htm" endpoint from the local network. Recommendations For versions 1.0...

CVE-2020-8798: Incorrect Default Permissions

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

CVE-2020-11542

3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the MYKEY substring...