3054 matches found
CVE-2019-8154
CVE-2019-8154 describes a remote code execution in Magento 2.x prior to certain patched versions. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion by submitting a crafted XML file that specifies product design update. Affected versions include Magent...
CVE-2019-8154
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update...
CVE-2019-8154: Inclusion of Functionality from Untrusted Control Sphere
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update...
CVE-2019-18195
An issue was discovered on TerraMaster FS-210 4.0.19 devices. Normal users can use 1.user.php for privilege elevation...
CVE-2013-4857
D-Link DIR-865L has PHP File Inclusion in the router xml file...
Design/Logic Flaw
D-Link DIR-865L has PHP File Inclusion in the router xml file...
CVE-2013-4857
D-Link DIR-865L has PHP File Inclusion in the router xml file...
CVE-2013-4857: XML Injection (aka Blind XPath Injection)
D-Link DIR-865L has PHP File Inclusion in the router xml file...
SQL injection vulnerability in zzcms backend in***.php file
zzcms is a free website builder developed in asp language. SQL injection vulnerability exists in zzzcms background in.php file. Attackers can use the vulnerability to obtain sensitive information in the database...
PT-2019-14894 · Fusionpbx · Fusionpbx
Name of the Vulnerable Software and Affected Versions: FusionPBX versions up to 4.5.7 Description: The issue arises from the file appcontactscontact times.php using an unsanitized id variable from the URL, which is then reflected in HTML. This leads to a cross-site scripting XSS issue, allowing...
CVE-2019-15748
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...
Code injection
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...
CVE-2019-15766
The KSLABS KSWEB aka ru.kslabs.ksweb application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to and the configtext parameter set to the content of the file to be created...
Remote code execution
The KSLABS KSWEB aka ru.kslabs.ksweb application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to and the configtext parameter set to the content of the file to be created...
SQL injection vulnerability in the ne***.cl***.php file of the Seven Bears library system
Seven bears library system a similar Baidu library online document preview, selling system. A SQL injection vulnerability exists in the ne.cl.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...
PT-2019-4018
Name of the Vulnerable Software and Affected Versions Openregion.security module of the "Otкрытый регион" platform affected versions not specified Description The issue exists due to insufficient input validation in the openregion.security module. This allows a remote attacker to execute arbitrar...
Dokeos 1.8.6.1 / 1.8.6.3 Arbitrary File Upload
Exploit Title: Dokeos 1.8.6.3 and 1.8.6.1- Arbitrary File Upload Google Dork: "Plateforme Dokeos 1.8.6.3 " or 1.8.6.1 Date: 17/09/2019 Exploit Author: Sohel Yousef Jellyfish security team Vendor Homepage: https://www.dokeos.com/ Software Link: https://www.dokeos.com/ Version: 1.8.6.3 - 1.8.6.1...
Command Execution Vulnerability in Fiserv Patrol au***.php File
Fisheye Web Patrol is an IT operations and maintenance management system. A command execution vulnerability exists in the Feith Web Patrol au.php file. An attacker can exploit the vulnerability to obtain the host webshell...
Cross site scripting
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...
Enigma NMS 65.0.0 - Cross-Site Request Forgery Exploit
Exploit for multiple platform in category web applications -------------------------------------------------------------------- Exploit Title: Enigma NMS Cross-Site Request Forgery CSRF Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor Homepage: https://www.netsas.com.au/...