CVE-2020-36485: Unrestricted Upload of File with Dangerous Type

Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file...

CVE-2021-42335 Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS

Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack...

CVE-2021-42329 ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS

The “ListAdd” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks...

S-CMS XML External Entity Injection Vulnerability

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 3.0 version of the /api/notify.php exists XML external entity injection vulnerability. An attacker can use this vulnerability to read arbitrary files...

WordPress Pie Register plugin <= 3.7.1.5 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by AyeCode Ltd in WordPress Pie Register plugin versions = 3.7.1.5. Solution Update the WordPress Pie Register plugin to the latest available version at least 3.7.1.6...

CVE-2020-24930: Undefined Security Weakness

Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 is an open source content management system. The five fingers CMS backend in.php file has arbitrary file deletion vulnerability. Attackers can use vulnerabilities to delete arbitrary files...

JVN#23406150: EC-CUBE plugin "Order Status Batch Change Plug-in" vulnerable to cross-site scripting

EC-CUBE plugin "Order Status Batch Change Plug-in" provided by ActiveFusions Co., Ltd. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by conducting a specific operation on the management page of EC-CUBE. Impact If a remote attacker injects a specially...

CVE-2021-26608

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

CVE-2020-7873

Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution...

CVE-2021-26608 handysoft groupware arbitrary file download and execution vulnerability

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

CVE-2021-26608

The provided records describe CVE-2021-26608 as an arbitrary file download and execution vulnerability in Handysoft Co., Ltd groupware ActiveX module, specifically the HShell.dll. Root cause: lack of integrity checking for the download URL or the downloaded file hash. Impact stated as allows arbi...

CVE-2020-7874 NEXACRO14 Runtime arbitrary file download and execution vulnerability

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension...

CVE-2020-7874

The CVE-2020-7874 entry relates to the NEXACRO14 Runtime ActiveX control from Tobesoft Co., Ltd. Affected component: NEXACRO14 Runtime ActiveX control. Root cause: incomplete validation of the file download URL or file extension. Consequence: enables arbitrary file download and execution. Exploit...

CVE-2020-7873

CVE-2020-7873 concerns a vulnerability in an ActiveX control from Younglimwon Co., Ltd where code can be downloaded without integrity checks, enabling arbitrary file download and execution. The Red Hat and NVD entries corroborate the description; other connected records reuse the same impact stat...

CVE-2021-26603

CVE-2021-26603 describes a heap overflow in Bandisoft’s ARK library caused by Ark_DigPathA parsing a file path without proper string length checks. The issue affects the ARK library and is documented with multiple sources (NVD, Red Hat, CVE lists). The vulnerability is described as a heap overflo...

CVE-2020-7873: Download of Code Without Integrity Check

Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution...

PT-2021-12694

Name of the Vulnerable Software and Affected Versions: Younglimwon Co., Ltd ActiveX control affected versions not specified Description: The issue allows an attacker to cause arbitrary file download and execution due to a download of code without integrity check vulnerability in the ActiveX...

CVE-2021-26608: Missing Support for Integrity Check

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

CVE-2021-26603: Heap-based Buffer Overflow

A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the ArkDigPathA function parsed a file path. This vulnerability is due to missing support for string length check...

bohai-ltd.com Cross Site Scripting vulnerability OBB-2134522

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...