PT-2024-27784 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue involves improper neutralisation of Server-Side Includes SSI through the Device NAS shared section, accessible via the /admin/DeviceNAS endpoint. This could allow a remote user to execute...

PT-2024-27798 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue involves improper neutralisation of Server-Side Includes SSI through S3 disks, specifically at the /admin/DeviceS3 endpoint. This could allow a remote user to execute arbitrary code,...

PT-2024-27790 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue involves improper neutralisation of Server-Side Includes SSI through Device Synchronizations at the "/admin/DeviceReplication" API endpoint. This could allow a remote user to execute arbitrar...

PT-2024-9989 · WordPress · Vibebp

Name of the Vulnerable Software and Affected Versions: VibeBP versions 1.9.9.4.1 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation. This vulnerability is associated with the vibebp register user function in the...

RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`

A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiate...

CVE-2024-2497

A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiate...

BIT-WORDPRESS-2020-25286

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...

PT-2023-10833 · Unknown · Mdalamin-Aol Own Health Record

Name of the Vulnerable Software and Affected Versions: MdAlAmin-aol Own Health Record versions 0.1-alpha through 0.3.1-alpha Description: This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated...

WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE

Description The plugin accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code...

The vulnerability of the Custom Includes module in the Nagios XI monitoring tool allows a hacker to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the Custom Includes module in Nagios XI is related to the unlimited loading of files of a dangerous type. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information...

Important: squid

Issue Overview: An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decod...

PT-2023-7871 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the Custom Includes module of Nagios XI, which is vulnerable to unrestricted file upload of dangerous types. This could allow a remote attacker to execute arbitrar...

CVE-2023-33665

ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

Sql injection

ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

CVE-2023-33666

ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

CVE-2023-33666

ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

PrestaShop ai-dev aitable SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. A security vulnerability exists in PrestaShop ai-dev aitable, which originates from an SQL injection that can be...

CVE-2023-33665

ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

Sql injection

ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

PT-2023-24443 · Unknown · Ai-Dev Aicombinationsonfly

Name of the Vulnerable Software and Affected Versions: ai-dev aicombinationsonfly versions prior to 0.3.1 Description: The issue is a SQL injection vulnerability. It affects the component /includes/ajax.php. Recommendations: For versions prior to 0.3.1, update to version 0.3.1 or later to resolve...