FIBARO System Home Center 5.021 - Remote File Include Vulnerability

Exploit for multiple platform in category web applications Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center...

tomcat: XSS in SSI printenv

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

Chadha PHPKB CSV Injection Vulnerability

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A CSV injection vulnerability exists in admin/include/operations.php in Chadha PHPKB Standard Multi-Language 9. An attacker can...

CVE-2020-10390: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in export.php vulnerable function called from include/functions-article.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php...

Horde Groupware Webmail Edition 5.2.22 PHAR Loading

exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 source =...

CVE-2020-10388: Improper Neutralization of Input During Web Page Generation

The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/report-referrers.php vulnerable file admin/include/functions-articles.php...

CVE-2020-10460: Improper Neutralization of Formula Elements in a CSV File

admin/include/operations.php via admin/email-harvester.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data...

CVE-2020-10461: Improper Neutralization of Input During Web Page Generation

The way comments in article.php vulnerable function in include/functions-article.php are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/manage-comments.php, via the GET parameter cmt...

Sql injection

An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter...

CVE-2019-17644

An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php...

CVE-2019-17643

An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php...

Exploit for CVE-2020-1938

CVE-2020-1938 Tomcat-fileinclude and filered Exploita...

Exploit for CVE-2020-1938

CVE-2020-1938 Suricata 检测规则 suricata CNVD-2020-10487...

PT-2020-7664

Name of the Vulnerable Software and Affected Versions OpenPAM versions 9.2 through 10.0 Description The issue arises from improper error handling when an include directive refers to a non-existent policy, causing the loaded policy chain to not be discarded. This allows attackers to bypass...

CVE-2014-3879: Improper Authentication

OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login 1 without a passwor...

CVE-2020-8803: Improper Limitation of a Pathname to a Restricted Directory

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via addtoprospectlist...

CVE-2013-2057

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...

Security feature bypass

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...

CVE-2013-2057

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...

CVE-2013-2057

YaBB through 2.5.2 is affected by a Local File Include vulnerability caused by the 'guestlanguage' cookie parameter, enabling inclusion of local files due to improper handling of the cookie value. Affected product/component: YaBB (web forum) up to version 2.5.2. Root cause: unsanitized cookie par...