nukeviet Deserialization of Untrusted Data vulnerability

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

CVE-2024-36531

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component...

CVE-2024-36528

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

CVE-2024-36528

CVE-2024-36528 affects Nukeviet v4.5 and earlier and Nukeviet-egov v1.2.02 and earlier, via a deserialization vulnerability that leads to code execution through /admin/extensions/download.php and /admin/extensions/upload.php. Exploitation details are not provided in the connected documents beyond...

Vinades NukeViet Security Breach

Vinades NukeViet is an open source content management system CMS from Vinades Vietnam. A security vulnerability exists in Vinades NukeViet v.4.5 and earlier versions, nukeviet-egov v.1.2.02 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code via the...

Vinades NukeViet Security Breach

Vinades NukeViet is an open source content management system CMS from Vinades Vietnam. A security vulnerability exists in Vinades NukeViet v.4.5 and earlier versions, nukeviet-egov v.1.2.02 and earlier versions, which stems from the presence of a deserialization vulnerability. An attacker can...

CVE-2024-36528

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

PT-2024-27049

Name of the Vulnerable Software and Affected Versions: nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier Description: The issue is related to a Deserialization vulnerability, which can result in code execution. This can be achieved via the "/admin/extensions/download.php...

CVE-2024-36531

CVE-2024-36531 affects nukeviet v4.5 and earlier and nukeviet-egov v1.2.02 and earlier. The vulnerability is described as arbitrary code execution via the /admin/extensions/upload.php component, due to improper validation in that upload handler. Impact and exploitability are supported by multiple...

CVE-2024-36528

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

PT-2024-27051

Name of the Vulnerable Software and Affected Versions: nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier Description: The issue allows for arbitrary code execution via the "/admin/extensions/upload.php" component. Recommendations: For nukeviet versions 4.5 and earlier,...

CVE-2024-36531

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component...

CVE-2024-36528

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php...

CVE-2024-36531

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component...

CVE-2024-36531

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component...

Cross-site Scripting (XSS)

nukeviet/nukeviet is vulnerable to cross-site scripting.The vulnerability exists in Request.php due to incorrectly neutralized user-controllable inputs which allows an attacker to inject and execute malicious javascript through Data URL Handler...

CVE-2022-3975

A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting...

CVE-2022-3975 NukeViet CMS Data URL Request.php filterAttr cross site scripting

A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting...

CVE-2022-3975

NukeViet CMS vulnerability CVE-2022-3975 affects the Data URL Handler’s filterAttr in vendor/vinades/nukeviet/Core/Request.php. Manipulating attrSubSet enables cross-site scripting, with remote execution possible. Upgrading to version 4.5 fixes the issue (patch: 0b3197fad950bb3383e83039a8ee4c9509...