CVE-2021-24845

The CVE refers to the WordPress plugin Improved Include Page, version

CVE-2021-24845 Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with posttype & poststatus which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to...

PT-2021-16326

Name of the Vulnerable Software and Affected Versions: Improved Include Page WordPress plugin versions 1.2 and earlier Description: The issue allows users with a role as low as Contributor to gain access to content they are not supposed to by passing shortcode attributes with post type and post...

CVE-2021-24845: Improper Access Control

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with posttype & poststatus which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to...

WordPress plugin Improved Include Page 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Librenms 跨站脚本漏洞

Librenms is a Librenms community PHP and MySQL-based open source network monitoring system . The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms version 21.11.0 has a cross-site scripting vulnerability that can be exploited by attackers via...

Librenms 跨站脚本漏洞

Librenms is a PHP and MySQL based open source network monitoring system for the Librenms community. The system features custom alerts, auto-discovery of network environments, and automatic updates.Librenms suffers from a cross-site scripting vulnerability that originates in...

CVE-2021-24644

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include function, which could lead to a Local File Inclusion issue...

CVE-2021-24644: Improper Limitation of a Pathname to a Restricted Directory

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include function, which could lead to a Local File Inclusion issue...

Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access

The plugin allows passing shortcode attributes with posttype & poststatus which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to. include-page allowtype="post" allowstatus="draft" id="131" include-page...

Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access

The plugin allows passing shortcode attributes with posttype & poststatus which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to. PoC include-page allowtype="post" allowstatus="draft" id="131"...

WordPress Improved Include Page plugin <= 1.2 - Arbitrary Posts/Pages Access vulnerability

Arbitrary Posts/Pages Access vulnerability discovered by Francesco Carlucci in WordPress Improved Include Page plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of October 8, 2021 and is not available for download. This closure is temporary, pending a full revi...

CVE-2021-29679

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include SSI directive. IBM X-Force ID: 199915...

Code injection

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include SSI directive. IBM X-Force ID: 199915...

IBM Cognos Analytics 代码注入漏洞

A remote code execution vulnerability exists in IBM Cognos Analytics version 11.1.7, 11.2.0, a suite of business intelligence software from IBM Corporation that provides valuable information, secure data governance, and reporting. The vulnerability stems from incorrect neutralization of...

PT-2021-18402

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.1.7 through 11.2.0 Description The issue allows an authenticated user to execute code remotely due to incorrectly neutralizing user-controlled input that could be interpreted as a server-side include SSI...

CVE-2021-29679

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include SSI directive. IBM X-Force ID: 199915...

PT-2021-5905

Name of the Vulnerable Software and Affected Versions D7800 versions 1.0.1.58 and earlier DM200 versions 1.0.0.66 and earlier EX2700 versions 1.0.1.56 and earlier EX6150v2 versions 1.0.1.86 and earlier EX6100v2 versions 1.0.1.86 and earlier EX6200v2 versions 1.0.1.78 and earlier EX6250 versions...

PT-2021-5849

Name of the Vulnerable Software and Affected Versions NETGEAR RBK40 versions prior to 2.5.1.16 NETGEAR RBR40 versions prior to 2.5.1.16 NETGEAR RBS40 versions prior to 2.5.1.16 NETGEAR RBK20 versions prior to 2.5.1.16 NETGEAR RBR20 versions prior to 2.5.1.16 NETGEAR RBS20 versions prior to 2.5.1....

PT-2021-5848

Name of the Vulnerable Software and Affected Versions NETGEAR RBK40 versions prior to 2.5.1.16 NETGEAR RBR40 versions prior to 2.5.1.16 NETGEAR RBS40 versions prior to 2.5.1.16 NETGEAR RBK20 versions prior to 2.5.1.16 NETGEAR RBR20 versions prior to 2.5.1.16 NETGEAR RBS20 versions prior to 2.5.1....