CVE-2022-39195

A cross-site scripting XSS vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter...

PT-2023-1013 · Sap · Sap Businessobjects Business Intelligence Analysis Edition For Olap

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Analysis edition for OLAP affected versions not specified Description: The issue allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On...

CVE-2022-44731

A vulnerability has been identified in SIMATIC WinCC OA V3.15 All versions V3.15 P038, SIMATIC WinCC OA V3.16 All versions V3.16 P035, SIMATIC WinCC OA V3.17 All versions V3.17 P024, SIMATIC WinCC OA V3.18 All versions V3.18 P014. The affected component allows to inject custom arguments to the...

CVE-2022-4322

The CVE-2022-4322 issue affects maku-boot up to version 2.2.0, specifically the Scheduled Task Handler’s doExecute function, where manipulation leads to injection. Remote exploitation is possible and the exploit has been disclosed publicly. The patch to fix this is named 446eb7294332efca2bfd791bc...

CVE-2022-41777

CVE-2022-41777 affects Nako3edit, the editor component of Nadesiko3 (PC Version) v3.3.74 and earlier. The root cause is an improper check/handling of exceptional conditions in Nako3edit that lets a remote attacker inject an invalid value into decodeURIComponent, which may cause the server to cras...

Remote Code Injection

phpxmlrpc/phpxmlrpc is vulnerable to code injection. An attacker can access local files or connect to undesired URLs instead of the intended target server's URL through the $client argument in the buildclientwrappercode function of Wrapper.php by injecting a malicious code...

CVE-2022-42925

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-41681

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-41681

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-42925

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

Code injection

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-41681 File Upload vulnerability in Forma LMS

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-41681

Forma LMS

CVE-2022-41681 File Upload vulnerability in Forma LMS

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-42925

CVE-2022-42925 affects Forma LMS 3.1.0 and earlier. An authenticated user with the student role can privilege-escalate via the plugin upload component to upload a ZIP file, which could lead to remote code execution. Public documentation lists this CVE with high/critical impact (CVSS/CRITICAL) and...

CVE-2022-42925 Unrestricted Upload of File with Dangerous Type in Forma LMS

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

CVE-2022-42925 Unrestricted Upload of File with Dangerous Type in Forma LMS

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker with the role of student to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection...

PT-2022-26023 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to privilege escalate and upload a Zip file through the SCORM importer feature, potentially leading to remote code injection...

CVE-2022-40238

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...

Code injection

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...