10310 matches found
CVE-2021-24430
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...
PT-2021-15960
Name of the Vulnerable Software and Affected Versions Speed Booster Pack PageSpeed Optimization Suite WordPress plugin versions prior to 4.2.0 Description The issue arises from the plugin not validating its caching exclude urls and caching include query strings settings before outputting them in ...
Landray EKP 跨站脚本漏洞
Landray EKP is an office automation solution that enables companies to easily model and manage... A cross-site scripting vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 could allow an attacker to execute arbitrary web script or HTML via a crafted...
CVE-2021-24453
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...
Path traversal
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...
CVE-2021-24453
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...
CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...
WordPress 路径遍历漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A path traversal vulnerability exists in the WordPress plugin Include Me, which stems from the...
PT-2021-15979
Name of the Vulnerable Software and Affected Versions Include Me WordPress plugin versions 1.2.1 and earlier Description The issue allows for path traversal and local file inclusion, potentially leading to Remote Code Execution RCE of the system due to log poisoning. This could result in a full...
CVE-2021-24453: Improper Limitation of a Pathname to a Restricted Directory
The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...
CVE-2020-22609
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-22608
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
PT-2021-10771
Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting vulnerability. It can be exploited via the queue-name parameter to the "/include/ajax.search.php" API endpoint. Recommendations For versions prior to...
PT-2021-10772
Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12.6 Description The issue is related to a Cross Site Scripting XSS vulnerability. It affects the queue-name parameter in the include/class.queue.php file. There is no information provided about the estimated numbe...
Enhancesoft osTicket 跨站脚本漏洞
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/ajax.search.php...
CVE-2020-22609: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-22608: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php...
Enhancesoft osTicket 跨站脚本漏洞
osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...
Command Injection in Centreon
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabasestatuspath via a main.get.php request and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page...