CVE-2025-8976: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

CVE-2025-8521: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack ma...

CVE-2023-4559: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may...

PT-2023-15600

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A remote code execution RCE vulnerability was discovered in the component "/rukovoditel/index.php?module=dashboard/ajax request". Recommendations For Rukovoditel version 3.2.1, consider disabling access to...

CVE-2022-45020: Improper Neutralization of Input During Web Page Generation

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...

CVE-2022-44948: Improper Neutralization of Input During Web Page Generation

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Entities Group feature at/index.php?module=entities/entitiesgroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2020-19159: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2021-34128: Unrestricted Upload of File with Dangerous Type

LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname...

CVE-2020-24877: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

CVE-2018-8047: Improper Neutralization of Input During Web Page Generation

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2018-20166: Unrestricted Upload of File with Dangerous Type

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...

CVE-2018-18772: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...

CVE-2018-18773: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

天融信异常流量系统index.php_module_ads_policy_action_database_sub_act_show&t_name参数注入

No description provided by source...

Ax Developer CMS 0.1.1 (index.php module) Local File Inclusion Vuln

No description provided by source. W w w . T r Y a G . C o m Ax Developer CMS 0.1.1 index.php module Local File Inclusion Vulnerability http://sourceforge.net/projects/axdcms/ POC : /index.php?module=../../../../../../../../etc/passwd%00 W w w . T r Y a G . C o m sebug.net...

Ax Developer CMS 0.1.1 (index.php module) Local File Inclusion Vuln

Exploit for unknown platform in category web applications =================================================================== Ax Developer CMS 0.1.1 index.php module Local File Inclusion Vuln =================================================================== Ax Developer CMS 0.1.1 index.php modu...

ax-lfi.txt

W w w . T r Y a G . C o m Ax Developer CMS 0.1.1 index.php module Local File Inclusion Vulnerability http://sourceforge.net/projects/axdcms/ POC : /index.php?module=../../../../../../../../etc/passwd%00 W w w . T r Y a G . C o m...