PT-2019-15232

Name of the Vulnerable Software and Affected Versions 74CMS version 5.2.8 Description An issue was discovered that allows SQL Injection, generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category API endpoint, specifically...

CVE-2019-17612: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...

PT-2019-15182

Name of the Vulnerable Software and Affected Versions Hotaru CMS version 1.7.2 Description A stored XSS issue was found in the admin index.php?page=settings SITE NAME field, allowing for potential exploitation. Recommendations For Hotaru CMS version 1.7.2, update to a newer version that contains ...

CVE-2010-5335: Improper Limitation of a Pathname to a Restricted Directory

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter script to basic/minimizer/index.php is not properly sanitised and can therefore be exploited t...

PT-2019-6603

Name of the Vulnerable Software and Affected Versions IceWarp Webclient versions prior to 10.2.1 Description The issue allows for directory traversal, potentially resulting in the loss of confidential data from IceWarp Mailserver and the operating system. Input passed via a certain parameter to t...

CVE-2015-9479

The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...

CVE-2019-17431

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

CVE-2019-17431: Cross-Site Request Forgery (CSRF)

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

PT-2019-7438

Name of the Vulnerable Software and Affected Versions ACF-Frontend-Display plugin through 2015-07-03 for WordPress Description The issue allows for arbitrary file upload via an action=upload request to "js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php". Recommendations For versions of t...

CVE-2015-9479: Unrestricted Upload of File with Dangerous Type

The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...

PT-2019-15152

Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20190705 beta Description An issue was discovered in the software, specifically a CSRF vulnerability in the public/index.php/admin/auth/admin/add endpoint. Recommendations For fastadmin version 1.0.0.20190705 beta, as a...

CVE-2019-17105

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17105

Centreon Web prior to 2.8.27 is affected by CVE-2019-17105 where the token generator in index.php is predictable. The issue is documented as a predictable token generator, enabling potential token guessing that could enable unauthorized access or session-related abuse. Connected sources also desc...

CVE-2019-17105

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17105: Use of Insufficiently Random Values

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

PT-2019-14945

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue concerns a predictable token generator in the index.php file. This predictability could potentially be exploited. Recommendations For versions prior to 2.8.27, update to version 2.8.2...

Remote code execution

Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...

CVE-2019-17046

CVE-2019-17046 affects Ilch 2.1.22. The vulnerability arises because PHP is listed under “Allowed files” on the index.php/admin/media/settings/index page, enabling remote code execution. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, osv.dev, CVE listings) as a remote code exe...

CVE-2019-17046: Unrestricted Upload of File with Dangerous Type

Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...

CVE-2015-9444: Improper Neutralization of Input During Web Page Generation

The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATHSELF...