EUVD-2026-97379

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

EUVD-2026-97381

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109175

MoguBlog versions through 6.2 are affected by an insecure direct object reference vulnerability in the /networkDisk/getFileList endpoint. Authenticated administrators can list network-disk files belonging to other administrators because the system filters by status, file type, or filePath but fai...

EUVD-2020-29214

Malware in sbrugna...

EUVD-2020-29215

Malware in sbrugna...

EUVD-2023-31327

Malicious code in bioql PyPI...

EUVD-2023-43553

Malicious code in bioql PyPI...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2023-39853

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module...

CVE-2020-8347

A reflective cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing...

CVE-2020-8348

A DOM-based cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

Rainbow external link network disk 安全漏洞

Rainbow external link network disk is a PHP network disk and external link sharing program by netcccyun's personal developer. A security vulnerability exists in Rainbow external link network disk version v.5.5, which stems from a cross-site scripting XSS vulnerability. A remote attacker can execu...

CVE-2024-30845

A Cross Site Scripting (XSS) vulnerability exists in Rainbow external link network disk v.5.5 , a PHP-based network disk and external link sharing program. A remote attacker can achieve arbitrary code execution by exploiting the validation component of the input parameters . To mitigate risk, it ...

CVE-2024-30845: Improper Control of Generation of Code

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 : amanda vulnerability (USN-6614-1)

The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6614-1 advisory. It was discovered that amanda did not properly check certain arguments. A local unprivileged attacker could possibly use this issu...

CVE-2023-39853

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module...

Sql injection

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module...