55 matches found
PT-2024-24230
Name of the Vulnerable Software and Affected Versions Ecommerce-CodeIgniter-Bootstrap affected versions not specified Description An issue in Ecommerce-CodeIgniter-Bootstrap allows a remote attacker to execute arbitrary code via the saveLanguageFiles method of the Languages.php component. This...
Unspecified Vulnerability in Hitachi Energy RTU500 series CMU Firmware (CNVD-2025-02735)
RTU500 is a series of industrial control components from Hitachi, Japan, mainly used in industrial control systems. A security vulnerability exists in Hitachi Energy RTU500 series CMU Firmware versions 12.0.1 through 12.0.14, which is caused due to a problem in the handling of stb language files,...
Joomla CMS Security Vulnerability
Joomla is an open source, cross-platform content management system CMS developed by the US Open Source Matters team using PHP and MySQL. A security vulnerability exists in Joomla CMS versions 1.6.0 through 4.4.0, and 5.0.0. The vulnerability stems from the fact that an attacker can disclose...
CVE-2023-26262
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management CM server...
CVE-2022-26159
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...
CVE-2022-26159
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml and similar pathnames for other languages, which contain all characters typed by all users, including the content of private...
IBM WebSphere Application Server路径遍历漏洞
IBM WebSphere Application Server WAS is by IBM in accordance with open standards, such as Java EE, XML and Web Services, development and distribution of an application server. A directory traversal vulnerability exists in IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0. An attacker can...
jenkins: Arbitrary file existence check in file fingerprints
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...
CVE-2020-6335
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...
CVE-2016-10755
AbanteCart 1.2.8 allows SQL Injection via the sourcelanguage parameter to admin/controller/pages/localisation/language.php and core/lib/languagemanager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php...
ABB M2M ETHERNET Improper Authentication Vulnerability
ABB M2M ETHERNET is a network analysis device from ABB Switzerland. An authorization issue vulnerability exists in ABB M2M ETHERNET FW version 2.22 and earlier and ETH-FW version 1.01 and earlier. An attacker can exploit this vulnerability to upload malicious language files...
F5 BIG-IP Denial of Service Vulnerability (CNVD-2018-21232)
F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the F5 BIG-IP. A remote attacker can exploit this vulnerability to cause a denial of service wh...
XML Parser Denial of Service Vulnerability in Various Huawei Products
Huawei S12700 and so on are enterprise switch products of Huawei China Company. XML parser is one of the XML parsers. A denial of service vulnerability exists in the XML parser in several Huawei products, which stems from the program's lack of validation of XML files. An attacker could cause a...
Wordpress <= 4.6.1 Arbitrary Code Execution Vulnerability Using Language Files
WordPress is a free and open source blogging software and content management system based on PHP and MySQL. system. An arbitrary code execution vulnerability exists in Wordpress = version 4.6.1 using language files. Arbitrary code execution is possible due to the use of pre-constructed language...
WordPress XCloner Plugin Static Code Injection Vulnerability
WordPress is a blogging platform developed using the PHP language that supports personal blog sites on servers with PHP and MySQL.XCloner is a plugin for backing up and restoring data and databases. A static code injection vulnerability exists in WordPress Xcloner that allows remote attackers to...
CVE-2015-4338
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language, as demonstrated by language/italian.php...
Code injection
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language, as demonstrated by language/italian.php...
CVE-2015-4338
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language, as demonstrated by language/italian.php...
