CVE-2023-33440

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=saveuser...

PT-2023-24344 · Unknown · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue allows for arbitrary code execution via the "/eval/ajax.php?action=save user" API endpoint. This could potentially lead to unauthorized access and control of the...

Faculty Evaluation System 安全漏洞

Faculty Evaluation System is a faculty evaluation system by the individual developer Carlo Montero. A security vulnerability exists in Sourcecodester Faculty Evaluation System v1.0, which originates from an attack that can execute arbitrary code via /eval/ajax.php?action=saveuser...

CVE-2023-27507

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it...

CVE-2023-27507

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it...

Path traversal

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it...

Unrestricted file upload

Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it...

Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Ultimate Dashboard - Settings - General"...

MicroEngine Mailform 路径遍历漏洞

MicroEngine Mailform is a PHP mail form from MicroEngine Japan. A security vulnerability exists in MicroEngine Mailform versions 1.1.0 through 1.1.8, which stems from a path traversal vulnerability that could allow a remote attacker to save an arbitrary file on the server and execute it...

PT-2023-21179 · Unknown · Microengine Mailform

Name of the Vulnerable Software and Affected Versions: MicroEngine Mailform versions 1.1.0 through 1.1.8 Description: The issue allows a remote attacker to save an arbitrary file on the server and execute it, given that the file upload function and server save option are enabled. This is due to a...

Cross-Site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of user input sanitization in the save grid option, which allows an attacker to inject arbitrary JavaScript code into the browser...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.9ESR) have affected APM Synthetic Playback Agent

Summary APM Synthetic Playback Agent is vulnerable to Firefox ESR CVE-2023-28163, CVE-2023-25752, CVE-2023-28164, CVE-2023-28162, CVE-2023-25751. Firefox ESR is used by APM Synthetic Playback Agent for running the selenium scripts. The fix includes support for Firefox 102.9 ESR. Vulnerability...

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird involve insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird are related to insufficient protection of sensitive data during the processing of save file requests via the “Save Link As” dialog box. Exploiting these vulnerabilities can allow an...

CVE-2023-2814

A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of the file /admin/saveteacher.php of the component POST Parameter Handler. The manipulation of the argument AcademicRank leads to cross site scripting. It is...

PT-2023-21588 · Sourcecodester · Sourcecodester Class Scheduling System

Name of the Vulnerable Software and Affected Versions: SourceCodester Class Scheduling System version 1.0 Description: A problematic vulnerability has been found in the SourceCodester Class Scheduling System. The issue affects an unknown function of the file /admin/save teacher.php, specifically...

SourceCodester Class Scheduling System 跨站脚本漏洞

Class Scheduling System is a class scheduling system. A cross-site scripting vulnerability exists in Class Scheduling System v1.0, which originates from the lack of effective filtering and escaping of user-supplied data in the AcademicRank parameter of the file /admin/saveteacher.php in the...

CVE-2023-2757

The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to insufficient input sanitization and output escaping. This...

The vulnerability of the configuration saving function in the web interface of D-Link DWL-2600AP wireless access points allows a intruder to execute arbitrary commands.

The vulnerability of the configuration saving function in D-Link DWL-2600AP wireless access points related to the lack of measures taken to neutralize special elements used in the operating system’s processing of the commands admin.cgi?action=configsave and downloadServerip. Exploiting this...

CVE-2023-31857

Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save...

kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copyxstatetouabi to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from initfpstate via copyfeature. But, dynamic states are not present ...