49 matches found
CVE-2022-35914_poc
CVE-2022-35914poc Modified for GLPI Offsec Lab: calluserfunc, arraymap, passthru References Modified to work for Proving Grounds Practice Lab: GLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.p...
CVE-2022-35914-RCE
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914 , a command-injection vulnerability involving the htmLawed test component in vulnerable GLPI installations. The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab...
HTMLawed
HTMLawed è ... ... uno script PHP monofile di 45 kb che rende il testo in input più sicuro, conforme agli standard HTML e, in generale, adatto dal punto di vista di un amministratore di pagine web, per l'uso nel corpo di documenti HTML, XHTML o XML. Una semplice alternativa a HTMLTidy, il filtro,...
GLPI <=10.0.2 - Remote Command Execution
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...
Exploit for Injection in Glpi-Project Glpi
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...
Exploit for Injection in Glpi-Project Glpi
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the cleanupXss function when sanitizing HTML content with conflicting htmLawed configuration options. An attacker can execute arbitrary JavaScript in the context of the affected application by injecting...
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
GHSA-3H6J-9X8M-RG3G Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection...
EUVD-2009-0408
Malware in sbrugna...
EUVD-2010-4333
Malware in sbrugna...
EUVD-2010-4611
Malware in sbrugna...
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...
ROS-20250303-02
Vulnerability in the htmlawed module of the GLPI computer hardware request, incident and inventory system is related to incorrect input validation in /vendor/htmlawed/htmlawed/htmlawed/htmLawedTest.php. Exploitation of the of the vulnerability could allow an attacker acting remotely to inject...
Teclib GLPI Remote Code Execution Vulnerability
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed...
HTMLawed < 1.2.9 Command Injection (CVE-2022-35914)
Binary data htmlawedcmdinjection.nbin...
HTMLawed < 1.2.9 Code Injection
In versions lower than 1.2.9 htmLawedTest.php in the HTMLawed module allows PHP code injection. No source data...
GLPI 10.0.2 Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GLPI htmLawed php command injection', 'Description' = %q This exploit takes advantage of a unauthenticated php command injection available from...
