24 matches found
CVE-2026-109218
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...
CVE-2026-109218
The Contact Manager plugin for WordPress (versions up to and including 9.1.2 ) is vulnerable to Arbitrary File Upload via the add_message function. The root cause is an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation rou...
CVE-2026-109218: kleor Contact Manager: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...
PT-2026-127859
Name of the Vulnerable Software and Affected Versions Contact Manager versions prior to 9.1.3 Description An arbitrary file upload issue exists in the add message function. This occurs because an incomplete extension blacklist fails to detect dangerous extensions when a trailing dot causes the...
EUVD-2018-21929
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across...
CVE-2018-25406
CVE-2018-25406 affects the eNdonesia Portal 8.7, where multiple SQL injection vulnerabilities allow unauthenticated attackers to run arbitrary SQL queries via mod.php. The attacker can inject SQL through parameters artid, cid, did, contid, and aboutid across modules including publisher, diskusi, ...
CVE-2018-25407 eNdonesia Portal 8.7 SQL Injection via mod.php
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across...
CVE-2018-25407 eNdonesia Portal 8.7 SQL Injection via mod.php
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across...
CVE-2018-25406 eNdonesia Portal 8.7 SQL Injection via mod.php
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across...
CVE-2018-25407
CVE-2018-25407 affects eNdonesia Portal 8.7, where multiple SQL injection flaws in mod.php allow unauthenticated attackers to execute arbitrary SQL via parameters such as artid, cid, did, contid, and aboutid across the publisher, diskusi, galeri, content, and about modules. The issue can be used ...
EUVD-2018-21927
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters to extract...
PT-2026-45107
Name of the Vulnerable Software and Affected Versions eNdonesia Portal version 8.7 Description Multiple SQL injection flaws allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod.php' endpoint. The issue exists within the publisher, diskusi,...
PT-2026-45105
Name of the Vulnerable Software and Affected Versions eNdonesia Portal version 8.7 Description Multiple SQL injection flaws allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod.php' endpoint. Specifically, the artid, cid, did, contid, and...
CVE-2021-39320
The underConstruction plugin = 1.18 for WordPress echoes out the raw value of $GLOBALS'PHPSELF' in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the...
SQL injection vulnerability in UQCMS cloud B2B2C multi-store system shop.mod.php file
UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. UQCMS Cloud Business B2B2C multi-store system shop.mod.php file SQL injection vulnerability, an attacker can exploit the vulnerability to obtain database sensitive information...
Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities
Binary data 9392.prm...
Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities
Binary data 9327.prm...
Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities
The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppSandbox - Bluetooth - CFNetwork HTTPProtocol - Compression - Configuration Profiles - CoreGraphics - CoreMedi...
Mac OS X < 10.11 Multiple Vulnerabilities (GHOST)
The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11. It is, therefore, affected by multiple vulnerabilities in the following components : - Address Book - AirScan - apachemodphp - Apple Online Store Kit - AppleEvents - Audio - bash - Certificate Trust Polic...