13520 matches found
i-doit CMDB 1.12 - Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: i-doit CMDB 1.12 - Arbitrary File Download Exploit Author: Ihsan Sencan Vendor Homepage: https://www.i-doit.org/ Software Link: https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip Version: 1.12...
PT-2019-18054
Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description A CSRF issue allows adding an admin account via the /adminsys/index.php?load=admins&act=edit info&act type=add API endpoint. Recommendations For HuCart version 5.7.4, as a temporary workaround, consider...
PT-2019-17967
Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows SQL injection via the "table" parameter in the admin/index.php endpoint, specifically "/admin/index.php?c=database table". This can lead to PHP code execution by using "INTO...
CVE-2019-6127: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...
CVE-2019-5886
An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...
CVE-2019-5886: Improper Locking
An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...
PT-2019-17844
Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0 Description An issue in the application allows an attacker to reinstall the database due to the lack of validation in the Add method of the Index.php file. This enables the attacker to write arbitrary code to database.php...
CVE-2019-5725
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
PT-2019-17833
Name of the Vulnerable Software and Affected Versions qibosoft versions through V7 Description The issue allows remote attackers to read arbitrary files via the main parameter in member/index.php, which can be exploited through Server-Side Request Forgery SSRF to read sensitive files, such as .sq...
CVE-2019-5725: Server-Side Request Forgery (SSRF)
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
CVE-2019-5488
EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...
PT-2019-17706
Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8 Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive...
CVE-2019-5488: Improper Neutralization of Special Elements used in an SQL Command
EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...
CVE-2019-5311
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
CVE-2019-5311
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
PT-2019-17574
Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.8 Description An issue was discovered in YUNUCMS, where the app/index/controller/Show.php file has a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the cw parameter in the...
CVE-2019-5311: Improper Neutralization of Input During Web Page Generation
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
