10507 matches found
PT-2022-7142
Name of the Vulnerable Software and Affected Versions XML Sitemap Generator for Google WordPress plugin versions prior to 2.0.4 Description The issue arises from the plugin's failure to validate a parameter, which can be set to an arbitrary value. This can lead to cross-site scripting XSS via err...
CVE-2022-1392
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...
CVE-2022-1392: Improper Limitation of a Pathname to a Restricted Directory
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...
GSD-2022-1001603 mm/kmemleak: reset tag when compare object pointer
mm/kmemleak: reset tag when compare object pointer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...
CVE-2022-27157
pearweb 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php...
PT-2022-18255
Name of the Vulnerable Software and Affected Versions pearweb versions prior to 1.32 Description The issue is related to a weak password recovery mechanism. It is specifically exploitable via the include/users/passwordmanage.php endpoint. Recommendations For versions prior to 1.32, update to...
PHP Smarty Template Handler Unauthorized Access
The vulnerability of PHP Smarty templates is related to deficiencies in handling arrays of trusted directories $trusteddir. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the include operator in the file:./../../../../../etc/passwd...
CVE-2022-27126
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...
CVE-2022-27133
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...
CVE-2022-27126
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...
CVE-2022-27133
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...
Sql injection
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...
Arbitrary file deletion
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...
CVE-2022-27126: Improper Neutralization of Special Elements used in an SQL Command
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...
CVE-2022-27133: Undefined Security Weakness
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...
PT-2022-18241
Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the "/include/up.php" API endpoint. Recommendations For zbzcms version 1.0, as a temporary workaround,...
PT-2022-18235
Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the art parameter at the "/include/make.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the art parameter in the "/include/make.php" endpoint...
CVE-2022-27462
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...
PT-2022-18434
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through 11.6 Description The issue is related to a Cross Site Scripting XSS vulnerability in the getDeviceID function within objects/function.php. This vulnerability can be exploited via the yptDevice parameter in the...
CVE-2022-27462: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...