COMPIE CMS Leado Local File Include Vulnerability

Exploit Title: COMPIE CMS Leado Local File Include Google Dork: /index.php?pathAjax= Date: 3/30/2022 Exploit Author: iranhack Security Team Vendor Homepage: iranhack.com Software Link: http://www.compie.co.il/ Version: V.1.0 Tested on: KaliLinux,windows 10 Local File Include...

CVE-2022-24803: Improper Neutralization of Special Elements used in an OS Command

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible...

Command Injection vulnerability in asciidoctor-include-ext

Impact Applications using Asciidoctor Ruby with asciidoctor-include-ext prior to version 0.4.0, which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when allow-uri-read is disable...

PT-2022-16889

Name of the Vulnerable Software and Affected Versions Asciidoctor-include-ext versions prior to 0.4.0 Description The issue allows an attacker to execute arbitrary system commands on the host operating system when used to render user-supplied input in AsciiDoc markup. This attack is possible even...

Ascidotector operating system command injection vulnerability

Asciidoctor is a text processor written in Ruby by the Asciidoctor organization. The product supports converting AsciiDoc content to HTML5, DocBook, and other formats. An operating system command injection vulnerability exists in versions prior to Asciidoctor-include-ext 0.4.0 that could allow an...

CVE-2021-26598

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26598

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

CVE-2021-26599: Improper Neutralization of Special Elements used in an SQL Command

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26598: Improper Authentication

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

PT-2022-9760

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.3 Description The issue is related to Incorrect Access Control in ImpressCMS, specifically in the include/findusers.php file, which allows access by unauthenticated attackers who have a security token by design...

WordPress Amministrazione Aperta 3.7.3 Arbitrary File Read

Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/ Date: 23-03-2022 Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/...

ImpressCMS SQL injection vulnerability

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a SQL injection vulnerability that stems from insufficient cleaning of user data passed in the groupps parameter of the...

CVE-2022-25505

Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php...

CVE-2022-25505: Improper Neutralization of Special Elements used in an SQL Command

Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php...

PT-2022-38028

Уязвимость функции skb pull модуля include/linux/skbuff.h ядра операционной системы Linux связана с копированием буфера без проверки размера входных данных классическое переполнение буфера. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Luocms Cross-Site Scripting Vulnerability

Luocms is an article management system. A cross-site scripting vulnerability exists in Luocms v2.0, which stems from a lack of data validation filtering of user-supplied data and output in /admin/news/sortadd.php and /inc/function.php. An attacker could use this vulnerability to execute JavaScrip...

CVE-2021-24823

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files...

PT-2022-9473

Name of the Vulnerable Software and Affected Versions The Support Board WordPress plugin versions prior to 3.3.6 Description The issue concerns the lack of CSRF checks in actions handled by the include/ajax.php file. This could allow attackers to make logged-in users perform unwanted actions, suc...

CVE-2021-24823: Cross-Site Request Forgery (CSRF)

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files...