CVE-2021-44892

A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...

Remote code execution

A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...

CVE-2021-44892

A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...

CVE-2021-44892: Undefined Security Weakness

A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...

PT-2022-12253

Name of the Vulnerable Software and Affected Versions ThinkPHP versions 3.x.x Description A Remote Code Execution RCE issue exists via the value filename in index.php, allowing a malicious user to obtain server control privileges. Recommendations For ThinkPHP versions 3.x.x, update to a version...

CVE-2021-45286

Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1 index.php, 2 bottom.php, and 3 topindex.php...

CVE-2021-45286: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1 index.php, 2 bottom.php, and 3 topindex.php...

CVE-2021-46360

Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...

PT-2022-12319

Name of the Vulnerable Software and Affected Versions ZZCMS version 2021 Description A Directory Traversal issue exists via the skin parameter in several PHP files, including "index.php", "bottom.php", and "top index.php". This allows for potential unauthorized access to sensitive files...

CVE-2021-46360: Unrestricted Upload of File with Dangerous Type

Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...

PT-2022-10310

Name of the Vulnerable Software and Affected Versions Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi version 1.0 Description A Cross Site Scripting XSS issue exists via the Category parameter in an add function in "category/index.php". Recommendations For Sourcecodester Gadget...

CVE-2021-34073: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php...

Sql injection

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php...

CVE-2022-23363

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php...

PT-2022-15953

Name of the Vulnerable Software and Affected Versions Online Banking System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the index.php file. Recommendations For Online Banking System version 1.0, consider restricting access to the index.ph...

CVE-2022-23363: Improper Neutralization of Special Elements used in an SQL Command

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php...

CVE-2021-44584

Cross-site scripting XSS vulnerability in index.php in emlog version = pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

PT-2022-12175

Name of the Vulnerable Software and Affected Versions emlog versions pro-1.0.7 and earlier Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the s parameter in the index.php file. This can be exploited by...

CVE-2021-44584: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in emlog version = pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2020-20946

CVE-2020-20946 affects Qibosoft v7 (CMS) with a stored XSS vulnerability in the admin path /admin/index.php?lfj=friendlink&action=add. The root cause is input data not validated in the friendlink/add handler, enabling injected client-side script execution. CVSS metrics indicate a Low to Medium ov...