13400 matches found
CVE-2021-44608: Improper Neutralization of Input During Web Page Generation
Multiple Cross Site Scripting XSS vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 file parameter and 2 type parameter in an edit action in index.php...
PT-2022-12186
Name of the Vulnerable Software and Affected Versions bloofoxCMS versions 0.5.1 through 0.5.2.1 Description Multiple SQL Injection vulnerabilities exist in the software via the URLs, lang id, tmpl id, mod rewrite, eta doctype, meta charset, default group, and page group parameters in the settings...
PT-2022-12185
Name of the Vulnerable Software and Affected Versions bloofoxCMS versions 0.5.1 through 0.5.2.1 Description Multiple Cross Site Scripting XSS vulnerabilities exist in the software. The issue is related to the file parameter and the type parameter in an edit action in the "index.php" endpoint...
CVE-2022-25099: Undefined Security Weakness
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-44610: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
CVE-2020-27467
A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php...
PT-2022-8857
Name of the Vulnerable Software and Affected Versions Processwire CMS versions prior to 2.7.1 Description A Directory Traversal issue exists via the download parameter to "index.php". Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue...
CVE-2020-27467: Improper Limitation of a Pathname to a Restricted Directory
A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php...
CVE-2022-23375
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...
Remote code execution
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...
CVE-2022-23375
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...
CVE-2022-23375
WikiDocs version 0.1.18 contains an authenticated remote code execution vulnerability. An attacker can upload a malicious file via the image upload form through index.php, enabling remote code execution. Multiple connected sources corroborate the issue, including Red Hat and other advisories. The...
WikiDocs 安全漏洞
WikiDocs is a database-free Markdown flat file Wiki engine from the personal developer Manuel Zavatta in Italy. WikiDocs suffers from a security vulnerability that stems from the fact that an attacker can exploit the vulnerability to upload malicious files via index.php using the image upload for...
CVE-2022-23375: Unrestricted Upload of File with Dangerous Type
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...
PT-2022-15959
Name of the Vulnerable Software and Affected Versions WikiDocs version 0.1.18 Description The issue allows for authenticated remote code execution. An attacker can exploit this by uploading a malicious file using the image upload form through the "index.php" endpoint. The image upload form is...
Cross-site Scripting (XSS) - Generic
Description The user-controlled GET user parameter in index.php is unsanitized resulting in Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/user File: /web/edit/user/index.phpL11 // Check user argument if empty$GET'user' header"Location: /list/user/"; exit; Request...
Cross-site Scripting (XSS) - Reflected
Description The user-controlled GET domain parameter in index.php is unsanitized resulting in Reflected Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/web/ // File: /web/edit/web/index.phpL28 // List domain $vdomain = $GET'domain'; // User controllable parameter if...
GHSA-75JP-87W2-C6X2 ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...
ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...