Design/Logic Flaw

An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tinymce/plugins/codemirror/dialog.php" URL. An attacker could execu...

CVE-2017-5961

Ionize versions up to 1.0.8 (IONIZE CMS built on CodeIgniter) are affected by an XSS vulnerability due to insufficient filtration of user-supplied data in the path parameter of the URL to ionize-master/themes/admin/javascript/tinymce/jscripts/tiny_mce/plugins/codemirror/dialog.php. This could all...

CVE-2017-5961: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tinymce/plugins/codemirror/dialog.php" URL. An attacker could execu...

Arbitrary file deletion

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

PT-2017-16600

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.x through 1.30.0 Description A file disclosure and inclusion issue exists due to unfiltered user-input being passed to the readfile function, allowing an authenticated attacker to read local system files, such as...

CVE-2017-5595: Exposure of Sensitive Information to an Unauthorized Actor

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

My Php Dating 'path' Parameter SQL Injection Vulnerability

My Php Dating 2.0 is an online dating site system. A SQL injection vulnerability exists in the My Php Dating 'path' parameter, which can be exploited by attackers to access or modify database data...

My Php Dating 2.0 - path Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: My Php Dating 2.0 - SQL Injection Web Vulnerability Google Dork: My Php Dating Date:09.01.2017 Vendor Homepage: http://www.phponlinedatingsoftware.com/demo.htm Tested on: http://www.phponlinedatingsoftware.com/demo/ Script Name:...

Joomla component com_joomanager parameter path arbitrary file download vulnerability

Joomla! is a content management system. An arbitrary file download vulnerability exists in the parameter path of the Joomla component joomanagerde. Allows an attacker to exploit the vulnerability to download sensitive information such as configuration files...

CVE-2016-5253

The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link...

PT-2016-5906

Name of the Vulnerable Software and Affected Versions HPE LoadRunner versions 11.52 through patch 3 HPE LoadRunner versions 12.00 through patch 1 HPE LoadRunner versions 12.01 through patch 3 HPE LoadRunner versions 12.02 through patch 2 HPE LoadRunner versions 12.50 through patch 3 Performance...

CVE-2016-2511

Cross-site scripting XSS vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php...

CVE-2016-2511

Cross-site scripting XSS vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php...

CVE-2016-2511: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php...

PT-2016-5173

Name of the Vulnerable Software and Affected Versions WebSVN versions 2.3.3 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the path parameter to "log.php" API endpoint. Recommendations For WebSVN versions 2.3.3 and earlier, consider updating t...

CVE-2016-2389

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence xMII component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. dot dot in the Path parameter to /Catalog, aka SAP Security Note 2230978...

CVE-2016-2389: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence xMII component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. dot dot in the Path parameter to /Catalog, aka SAP Security Note 2230978...