XWiki Platform 注入漏洞

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from XWiki France. An injection vulnerability exists in XWiki Platform, which arises from the ability of a user without scripting or programming privileges to edit a user profile or any other document and add...

PT-2023-20319 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.3 Description: The issue concerns the DataEase platform, an open source data visualization and analysis tool. When saving a dashboard, an attacker can modify the saved data to store malicious code. This can lea...

PHP 安全漏洞

PHP is a scripting language in which PHP is executed server-side. PHP has a security vulnerability. An attacker exploiting the vulnerability can read or change data...

FeehiCMS 代码问题漏洞

FeehiCMS is a Php-based CMS builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.0.8, which originates from an arbitrary file upload vulnerability during avatar upload. An attacker can exploit this vulnerability to execute related PHP code...

CVE-2022-27662

On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context...

CVE-2022-27662

On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context...

UBUNTU-CVE-2020-13671

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to...

lemlist: Unrestricted File Upload on https://app.lemlist.com

Summary: Hi! i found an Unrestricted File Upload on https://app.lemlist.com which let me upload anything. File Extensions Such as .html and others should not be executed on the server side. Steps To Reproduce: add details for how we can reproduce the issue 1. Login to https://app.lemlist.com 2. G...

IBM WebSphere Commerce Code Injection Vulnerability

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. A security vulnerability exists in IBM WebSphere Commerce that stems from the program'...

Spring Data Commons Remote Code Execution Vulnerability

Spring Data is a project module in the Spring Framework that provides access to the underlying data , Spring Data Commons is a shared base module . A remote code execution vulnerability exists in Spring Data Commons. The vulnerability is due to the Spring Data Commons module using SpEl expression...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

Drupal Elysia Cron Module Arbitrary PHP Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP language maintained by the Drupal community, and Elysia Cron is one of the cron job management modules. An arbitrary PHP code execution vulnerability exists in the Drupal Elysia Cron module. An attacker can exploit the...

Exponent CMS Arbitrary Code Execution Vulnerability

Exponent CMS employs an intuitive and flexible content editing system that allows website pages to be edited on-page as it is displayed. An arbitrary code execution vulnerability exists in Exponent CMS due to a failure to properly validate user input. An attacker could exploit the vulnerability t...

Nextcloud: Arbitrary File Upload in Logo & Log in image Theming setting.

Hi team First I think this vulnerability doesn't fall at your bug bounty program but this is a bad design that should fix right now cause if an attacker get admin access he still can upload a malicious file in client server side. I saw that Logo & Log in image allow to upload other files type...

Pornhub: [RCE] Unserialize to XXE - file disclosure on ams.upload.pornhub.com

Researcher was able to exploit a serialization error in the SimpleXMLElement class to perform object injection using the callbackUrl parameter. Researcher was successful in achieving the following: SSRF Local file inclusion Limited execution of database commands without output I exploited the...

QNAP TS-x09 Turbo NAS Cross Site Scripting

On the 7th of July 2015 I discovered a reflected cross-site scripting XSS vulnerability in QNAP TS-x09 Network Attached Storage devices. Full disclosure was undertaken with the vendor and a CVE-ID has been requested from Mitre. CVE-ID: requested via PGP email 7th July 2015 Author: Mark Cross...

Code injection

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...