9959 matches found
PT-2021-3232
Name of the Vulnerable Software and Affected Versions Invision Community aka IPS Community Suite versions prior to 4.6.0 Description The issue is related to the IPScmsmodulesfrontpages builder::previewBlock method interacting unsafely with the IPS Theme::runProcessFunction method, allowing for...
CVE-2021-32924: Improper Control of Generation of Code
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
IPS Community Suite 4.5.4.2 PHP Code Injection
------------------------------------------------------------------------------ IPS Community Suite = 4.5.4.2 previewBlock PHP Code Injection Vulnerability ------------------------------------------------------------------------------ - Software Link: https://invisioncommunity.com - Affected...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description Hi, few days ago I reported this vulnerability : https://huntr.dev/bounties/8-other-FalconChristmas/fpp/ There were 2 XSS vectors in https://github.com/FalconChristmas/fpp/blob/f032d800a67ed280f8d577d95519a71c95114579/www/runEventScript.phpL41 : php \n"; // 1 // else ? ERROR: Unknow...
CVE-2021-30461
A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value which might contain PHP code is injected into config/configuration.php...
CVE-2021-30461
A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value which might contain PHP code is injected into config/configuration.php...
Remote code execution
A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value which might contain PHP code is injected into config/configuration.php...
Unspecified Vulnerability in Nagios
Nagios is a set of open source and free network monitoring tools from the American company Nagios. A security vulnerability exists in Nagios Fusion version 4.1.8 and earlier, which can be exploited by an attacker to escalate privileges to Nagios by installing a malicious component containing PHP...
CVE-2020-28904
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code...
Privilege escalation
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code...
CVE-2020-28904
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code...
Codiad 2.8.4 Remote Code Execution
Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated 2 Date: 21.05.2021 Exploit Author: Ron Jost Hacker5preme Credits to: https://herolab.usd.de/security-advisories/usd-2019-0049/ Tobias Neitzel Vendor Homepage: http://codiad.com/ Software Link:...
CVE-2020-28904: Improper Privilege Management
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code...
Codiad 2.8.4 - Remote Code Execution (Authenticated) Exploit
Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated 2 Exploit Author: Ron Jost Hacker5preme Credits to: https://herolab.usd.de/security-advisories/usd-2019-0049/ Tobias Neitzel Vendor Homepage: http://codiad.com/ Software Link: https://github.com/Codiad/Codiad/releases/tag/v.2.8.4...
PT-2021-3224
Name of the Vulnerable Software and Affected Versions Nagios Fusion versions 4.1.8 and earlier Description The issue is related to the execution with unnecessary privileges, allowing for privilege escalation as nagios via the installation of a malicious component containing PHP code. This is due ...
PT-2021-3652
Name of the Vulnerable Software and Affected Versions QibosoftX1 version 1.0 Description A code injection issue has been found in the Upgrade function, related to incorrect code generation management in components such as client upgrade edition.php and Upgrade.php. This allows an attacker to...
CVE-2020-20092
File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...
Unrestricted file upload
File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...
PT-2021-10430
Name of the Vulnerable Software and Affected Versions: ArticleCMS version 1.0 Description: A File Upload issue exists via the image upload feature at "/admin" by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute...
