Voipmonitor 授权问题漏洞

VoIPmonitor is an open source network packet sniffer from the VoIPmonitor team. Has a commercial front-end for the SIP RTP RTCP SKINNY SCCP MGCP WebRTC VoIP protocol running on Linux. Voipmonitor suffers from a security vulnerability that stems from an error check in cdr.php, a component of the...

DEBIAN-CVE-2021-21408

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

CVE-2021-21408 Access to restricted PHP code by dynamic static class access in smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

Opmantek Open-AudIT 安全漏洞

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. A security vulnerability in Opmantek Open-AudIT prior to version 3.5.0, which originated in...

ZZCMS 跨站请求伪造漏洞

ZZCMS is a content management system CMS by China Zzcms team. ZZZCMS V1.7.1 suffers from a cross-site request forgery vulnerability, which stems from the lack of token validation for cross-site request forgery in the saveuser function in save.php...

SUSE SLED12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2021:3927-1)

The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3927-1 advisory. - CVE-2021-21707: Fixed special character breaks path in xml parsing bsc1193041. Tenable has extracted the preceding description block directly...

twmap 跨站脚本漏洞

Twmap is a Taiwan map-related document/code for China. twmap is vulnerable to a cross-site scripting vulnerability that originates in the file list.php, where the exit function will terminate the script and print a message to the user. No detailed vulnerability details are currently available...

SUSE SLED12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2021:3726-1)

The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3726-1 advisory. - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM bsc1192050. Tenable has extracted the preceding description block directly from...

CVE-2021-42669

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

Engineers Online Portal SQL注入漏洞

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection. An attacker can exploit the vulnerability to extract sensitive data from the web server via the id parameter of quizquestion.php and, in some cases...

CVE-2020-18259

ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting XSS vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields...

Vulnerability fixed in php

A vulnerability has been fixed in php. The vulnerability allows a local malicious party to obtain elevated privileges. PHP developers have released updates to fix the vulnerability. More information can be found at the page below: https://www.php.net/ChangeLog-8.php8.0.12 -= Fedora =- Fedora has...

Employee Record Management System 1.2 SQL Injection

Title: Employee Record Management System 1.2 - 'empid' SQL injection Unauthenticated Exploit Author: Anubhav Singh Date: 2021-10-31 Vendor Homepage: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/ Version: 1.2 Software Link:...

PT-2021-16825 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows an administrator-privileged user to write files on the filesystem using flag and code variables in the file save.php. This is due to insecure file write. Recommendations:...

The vulnerability of the HgDriver component of the PHP Composer dependency manager relates to the implementation or modification of arguments, allowing attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the HgDriver component in the PHP Composer dependency manager is related to improper cleaning of Mercurial repository URLs. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures through the...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : PHP vulnerability (USN-5125-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5125-1 advisory. It was discovered that PHP-FPM in PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or...

Exploit for Out-of-bounds Write in Php

This is an exploit module for a bug in php-fpm CVE-2019-11043. The exploit targets a vulnerability in certain nginx + php-fpm configurations, allowing a web user to execute code if the configuration is vulnerable. The exploit works by appending a specially crafted URL to the web server, which...

Medium: php73

Issue Overview: Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a response packet causing a stack buffer overflow, does not verify the data and uses the wrong type to cast length leading to a crash, and does not validate the...

SUSE SLED12: apache2-mod_php72 / php72 / php72-bcmath / php72-bz2 / etc (SUSE-SU-2021:2564-1)

The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2564-1 advisory. - CVE-2021-21705 bsc1188037: SSRF bypass in FILTERVALIDATEURL Tenable has extracted the preceding description block directly from the SUSE...

Twothink 安全漏洞

Twothink is a software application. Twothink is an open source content management framework developed using the latest ThinkPHP version 5.0.2 to provide a more convenient and secure WEB application development experience , using a new architectural design and namespace mechanism , a blend of...