239 matches found
Winter 安全漏洞
Winter is a free, open source, self-hosted CMS platform based on the Laravel PHP framework. A security vulnerability exists in Winter v.1.2.3 that originated from a vulnerability that allows remote attackers to execute arbitrary code via CMS page fields and plugin components using a crafted paylo...
Imperva uncovers new Indicators of Compromise for FBI and CISA-flagged AndroxGh0st botnet
On January 16, a joint alert from FBI and CISA warned about a concerning development: the emergence of a botnet driven by AndroxGh0st malware targeting vulnerable applications and web servers. AndroxGh0st is a Python-based malware, first seen in late 2022, designed to target Laravel .env files an...
Juzaweb CMS Security Vulnerability
Juzaweb CMS is a content management system developed by Juzaweb Individual Developer based on the Laravel framework and Web platform. A security vulnerability exists in Juzaweb CMS 3.4 and earlier versions, which stems from an Access Control Error vulnerability due to failure to properly validate...
Winter Cross-Site Scripting Vulnerability
Winter is a free, open source, self-hosted CMS platform based on the Laravel PHP framework. A cross-site scripting vulnerability exists in Winter versions prior to 1.2.4, which stems from the presence of a stored cross-site scripting XSS vulnerability...
Juzaweb CMS Cross-Site Scripting Vulnerability
Juzaweb CMS is a content management system developed by Juzaweb individual developers based on the Laravel framework and Web platform. A cross-site scripting vulnerability exists in Juzaweb CMS v.3.4 and earlier versions that could allow a remote attacker to execute arbitrary code by injecting a...
Dexx CMS HTML And Site Builder 2.2.3 XSS / Arbitrary File Upload
==================================================================================================================================== | Title : Dexx CMS - HTML and Site Builder V2.2.3 Remote File Upload vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...
Architect HTML And Site Builder 2.2.3 File Upload
==================================================================================================================================== | Title : Architect - HTML and Site Builder V 2.2.3 Remote File Upload vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...
Faveo Helpdesk 跨站脚本漏洞
Faveo Helpdesk is Faveo's open source ticketing system built on the Laravel framework. A security vulnerability exists in Faveo Helpdesk Enterprise version 6.0.1, which stems from the vulnerability of the application to stored XSS, allowing an attacker with proxy privileges to perform privilege...
Laravel 安全漏洞
Laravel is a web application framework from the Laravel community. A security vulnerability exists in Laravel versions 8.x through 9.x through versions prior to 9.32.0, which stems from the authentication method being found vulnerable to attack...
PT-2023-2176
Name of the Vulnerable Software and Affected Versions Snappy versions prior to 1.4.2 Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file exists function. If an attacker can upload files of any type to the server, they...
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...
PT-2022-8311 · Unknown · Laravel Framework
Name of the Vulnerable Software and Affected Versions: Laravel Framework version 5.7.x Description: A deserialization vulnerability exists in the Illuminate component of the Laravel Framework, which can lead to remote code execution if the content is controllable. This issue is related to the...
编号撤回
Laravel, a web application framework from the Laravel Team Laravel, has a security vulnerability that stems from a vulnerability in 1 RoutingPendingResourceRegistration.php via destruct, 2 cal in QueueCapsuleManager.php and 3 the deserialization pop-up chain invoke in...
CVE-2021-45040
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...
GHSA-W2PM-R78H-4M7V OS Command Injection in Laravel Framework
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17...
OS Command Injection in Laravel Framework
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17...
OS Command Injection
laravel/framework is vulnerable to OS command injection. The vulnerability exists through Filesystem.php where the 'link' function does not properly escape the arguments, allowing an attacker to inject arbitrary OS commands...
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17...
