47 matches found
CVE-2024-34470
CVE-2024-34470 Description: An Unauthenticated user can abuse Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server...
CVE-2024-34470
HSC MailInspector - CVE-2024-34470 Une vulnérabilité critique a été découverte dans HSC Mailinspector jusqu'à la version 5.2.18. Cette vulnérabilité affecte une fonctionnalité inconnue du fichier /public/loader.php. La manipulation de l'argument 'path' avec une entrée inconnue conduit à une...
wordpress_cve-2018-6389
wordpresscve-2018-6389 Tries to exploit a WordPress vulnerability CVE-2018-6389 which can be used to cause a Denial of Service. WARNING: This software does not perform DoS on vulnerable targets; it executes one HTTP GET call only to check if the vulnerability is present. This software is written ...
CVE-2026-58455: Execution After Redirect (EAR)
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit after an authentication redirect in loader.php combined with unsanitized input passed to shellexec in...
CVE-2026-48241 Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php a public-facing database utility that are committed to the source repository. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed...
CVE-2026-48241
Open ISES Tickets before 3.44.2 stores MySQL credentials in loader.php as hardcoded values committed to the source tree. This allows any reader of the public source or an unauthenticated read on a deployed install to obtain username, password, and database name and potentially connect to the data...
CVE-2026-48241: Use of Hard-coded Credentials
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php a public-facing database utility that are committed to the source repository. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed...
tickets 信任管理问题漏洞
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a vulnerability related to trust management. This vulnerability stemmed from hardcoding MySQL database credentials in the loader.php file and submittin...
EUVD-2022-29790
Malicious code in bioql PyPI...
CVE-2022-25046
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
GHSA-X38C-V778-W56M ICEcoder Path Traversal vulnerability
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...
CVE-2024-41373
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...
CVE-2024-41373
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...
CVE-2024-41373: Improper Limitation of a Pathname to a Restricted Directory
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...
CVE-2024-41373
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php...
CVE-2024-41373
ICEcoder version 8.1 is susceptible to a Path Traversal vulnerability within the lib/backup-versions-preview-loader.php file. This flaw allows for improper limitation of a pathname to a restricted directory. As a remediation, it is recommended to restrict access to the affected file until a forma...
CVE-2024-34470: Path Traversal: '\..\filename'
An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read...
Improper Access Control
moodle/moodle is vulnerable to Improper Access Control. The vulnerability exists in parsefileinformationfromurl function of lang.php and loader.php due to improper folder restrictions which allows an attacker to send a specially crafted HTTP request and create arbitrary folders on the system...
CVE-2021-45467: Missing Authorization
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/accountnewcreate&acc=guadaapi URI. Any number of %00...
