CVE-2024-27515

Osclass 5.1.2 is vulnerable to SQL Injection per multiple sources (CVE-2024-27515). The connected documents confirm the affected software and vulnerability class but do not provide concrete exploit vectors, affected modules, root-cause details, or a patch/fix. No remediation details are specified...

PT-2024-21925 · Osclass · Osclass

Name of the Vulnerable Software and Affected Versions: Osclass version 5.1.2 Description: The issue is related to SQL Injection. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations:...

CVE-2024-27515

Osclass 5.1.2 is vulnerable to SQL Injection...

Osclas Path Traversal Vulnerability

Osclass is an open source content management system CMS based on PHP and MySQL for creating and managing classified advertisement websites. A path traversal vulnerability exists in Osclas version 3.6.1. The vulnerability stems from a failure of a networked system or product to properly filter...

CVE-2016-10751

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...

CVE-2016-10751

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...

Directory traversal

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...

CVE-2016-10751

osClass 3.6.1 contains a Directory Traversal in oc-admin/plugins.php via the plugin parameter, enabling remote PHP code execution by uploading a PHP-containing image through index.php?page=ajax&action=ajax_upload. Exploitation details are described in multiple sources; the root cause is improper ...

CVE-2016-10751

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...

Design/Logic Flaw

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

OSclass 3.7.4 Cross Site Scripting

Multiple Cross-site Scripting Vulnerabilities in OSclass 3.7.4 Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in OSclass 3.7.4 Affected Software: OSclass Affected Versions: 3.7.4 Homepage: https://osclass.org/ Vulnerability: Reflected...

osClass 3.6.1: Remote Code Execution via Image File

RIPS Analysis RIPS was able to scan the 156,000 lines of code in just 23 seconds. Looking at the scan results, a high number of vulnerabilities were detected in this project. Especially high-rated vulnerabilities seem to make the race. However, there is no critical-rated vulnerability found on th...

Osclass 3.5.9 SQL Injection

Advisory ID: HTB23287 Product: Osclass Vendor: https://osclass.org/ Vulnerable Versions: 3.5.9 and probably prior Tested Version: 3.5.9 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Vendor Patch: January 25, 2016 Public Disclosure: Februa...

Osclass SQL Injection Vulnerability

OSClass is a PHP MySQL based development , used to create and manage classified ads website open source system . Osclass suffers from a SQL injection vulnerability. Because the input passed to the "/index.php" PHP script via the "itemsPerPage" HTTP GET parameter fails to filter user input, an...

SQL Injection in Osclass

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database an...

CVE-2014-8085

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...