Code Execution Vulnerability in FineCMS Frontend file and param parameters

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the name and param parameters in the frontend of FineCMS version 5.0.7, which allows remote attackers to execute arbitrary code without logging in...

Schneider Electric U.motion Builder editobject remote code execution vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in the Schneider Electric U.motion Builder editobject. The underlying SQLite database query requires SQL injection on the type input parameter. A remote attacker could exploit the...

WordPress Spiffy Calendar Plugin Cross-Site Scripting Vulnerability

WordPress is a suite of blogging platforms developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers running PHP and MySQL.Spiffy Calendar plugin is a plugin for managing and displaying user event and appointment information. A...

Xionghai CMS system cid parameter exists sql injection vulnerability

XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. Applicable to personal blogs, personal websites, corporate websites and other various purposes, the front end of the computer, mobile t...

Open redirect

An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter...

Wordpress plugin Social Stream API secret key information leakage vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Wordpress plugin Social-Stream uses the Twitter API key as a parameter of the URL link There is an information leakage that can be...

CMS Made Simple Remote Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A remote code execution vulnerability exists in CM...

Accellion FTA Device Cross-Site Scripting Vulnerability (CNVD-2017-07451)

Accellion FTA devices is a file transfer device from Accellion USA. The device supports file transfer, file sharing, file transfer tracking and reporting, and more. A cross-site scripting vulnerability exists in home/seos/courier/useradd.html in Accellion FTA devices versions prior to FTA912180. ...

CVE-2017-8792

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in home/seos/courier/useradd.html with the param parameter...

SemCms /semcms/view.php page ID parameter has SQL injection vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SemCms /semcms/view.php page ID...

CVE-2017-3896

CVE-2017-3896 concerns McAfee Agent’s remote log viewer: an unvalidated parameter in the remote log viewing capability (in 5.0.x before 5.0.4.449) allows an unauthenticated, remote attacker to submit crafted URLs, triggering a denial-of-service. Connected sources corroborate the flaw and fix path...

SQL Injection Vulnerability in Department Parameters of Guangzhou Zhongda Kaixuan Electronic Technology Co.

Guangzhou Zhongda Kaixuan Electronic Technology Co., Ltd. online office hall is a comprehensive e-government service platform integrating social management, public service, information disclosure and efficiency supervision. There is a SQL injection vulnerability in the department parameter of the...

SQL Injection Vulnerability in the id Parameter of Nanchangwei.com Electronic Newspaper System

"VNN Digital Newspaper" is a professional software product for digitizing newspapers, which can provide a perfect solution for paper newspapers to go online. It allows the original newspaper layout to be quickly and easily presented to readers through the Internet. There exists a SQL injection...

SQL Injection Vulnerability in the Keyword Parameter of Digital Newspaper System of Joyful Reading Kiosk

Joyful Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. A SQL injection vulnerability exists in the keyword parameter of the Joyfully Reading Kiosk Digital Newspaper System. An attacker can exploit the vulnerability to obtain database information...

IAS CMS index.php parameter id SQL injection vulnerability

No description provided by source...

网达信联电子采购系统 /epro/ebid/viewInvite1.asp 文件 InviteId 参数SQL注入漏洞

No description provided by source...

CVE-2016-3728

It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user...

SolarWinds Storage Resource Monitor Profiler Module ProcessesServlet SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Resource Monitor Profiler Module. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of the ProcessesServlet servlet in the...

kingdee /kingdee/portal/portlet/document/set.jsp等99处参数portal_id SQL盲注漏洞

No description provided by source...

Adobe Flash TextField.replaceText - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=584 There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with valueOf defined, the parent object of the TextFiel...