807 matches found
CVE-2021-24704
In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...
CVE-2018-14474
views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup...
CVE-2018-18376
goform/getWlanClientInfo in Orange AirBox Y858FL01.1604 allows remote attackers to discover information about currently connected devices hostnames, IP addresses, MAC addresses, and connection time via the rand parameter...
📄 Craft CMS Image Transform Pre-Authenticaton Remote Code Execution
This Metasploit module exploits an unauthenticated remote code execution vulnerability in Craft CMS versions 3.x, 4.x, and 5.x prior to 5.6.17 via the image transform endpoint. It injects a PHP Meterpreter payload into the Craft session, then triggers its execution by abusing the Yii behavior...
MAL-2025-1371 Malicious code in orange-meets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37037d337633f63999cc9026f347d4542faaf8a86bc78184e98a7031c17cfbe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in orange-meets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37037d337633f63999cc9026f347d4542faaf8a86bc78184e98a7031c17cfbe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-775 Malicious code in @orange-team/map-rank-tracker-frontend (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in uncertain-orange-snake (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9891 Malicious code in uncertain-orange-snake (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in semantic-orange-shrew (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9836 Malicious code in semantic-orange-shrew (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in secret-orange-junglefowl (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9831 Malicious code in secret-orange-junglefowl (npm)
--- -= Per source details. Do not edit below this line.=-...
Ubuntu: Security Advisory (USN-6885-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Exploit for Improper Encoding or Escaping of Output in Apache Http_Server
CVE-2024-38473 Nuclei Template !imagehttps://github.com/us...
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
...
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
...
Facebook Ads Lead to Fake Websites Stealing Credit Card Information
Facebook users are the target of a scam e-commerce network that uses hundreds of fake websites to steal personal and financial data using brand impersonation and malvertising tricks. Recorded Future's Payment Fraud Intelligence team, which detected the campaign on April 17, 2024, has given it the...