13518 matches found
PT-2019-12881
Name of the Vulnerable Software and Affected Versions IceWarp Mail Server versions prior to 10.4.5 Description The issue is related to a local file inclusion vulnerability. This can be exploited via the /webmail/calendar/minimizer/index.php API endpoint, specifically by manipulating the style...
CVE-2019-9106
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php files, as demonstrated by menu=php://filter/convert.base64-encode/resource=index.php to read index.php...
Joomla and WordPress Found Harboring Malicious Redirect Code
Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...
CVE-2019-11876
In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...
PT-2019-12536
Name of the Vulnerable Software and Affected Versions PrestaShop version 1.7.5.2 Description The issue concerns a Reflected XSS affecting the shop country parameter in the install/index.php installation script/component. Exploitation requires a user to follow the initial setup stages, including...
PT-2019-7547
Name of the Vulnerable Software and Affected Versions osClass version 3.6.1 Description The issue allows for directory traversal via the plugin parameter, which can be exploited for remote PHP code execution. An administrator can upload an image containing PHP code in the EXIF data through the...
CVE-2019-11876: Improper Neutralization of Input During Web Page Generation
In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...
Sql injection
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...
CVE-2019-10852
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...
CVE-2019-10852: Improper Neutralization of Special Elements used in an SQL Command
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...
PT-2019-12056
Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authenticated blind SQL injection via the id GET parameter in the "index.php?m=servers&a=start pulling&id=" endpoint. This can be exploited as demonstrated by injecting a substring in...
Sql injection
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...
PT-2019-12718
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows SQL Injection via the cvalue parameter in the "index.php?do=sadmin ceditpost" endpoint. Recommendations For UCMS version 1.4.7, avoid using the cvalue parameter in the "index.php?do=sadmin...
CVE-2019-12251: Improper Neutralization of Special Elements used in an SQL Command
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...
Sql injection
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
PT-2019-9632
Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows SQL Injection, which can be exploited through specific API endpoints, such as "index.php?p=accomodation&q=SQL", "index.php?p=rooms&q=SQL", or "admin/login.php"...
CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...