Loan Management System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Loan Management System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits...

Employees Pay Slip PDF Generator System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Employees Pay Slip PDF Generator System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefo...

PT-2024-12118 · Softexpert · Softexpert Excellence Suite

Name of the Vulnerable Software and Affected Versions: Softexpert Excellence Suite version 2.1 Description: A file upload issue allows attackers to execute arbitrary code by uploading a .php file to the "form/efms exec html/file upload parser.php" endpoint. Recommendations: For Softexpert...

flusity CMS 安全漏洞

flusity CMS is a user interactive interface solution where code can be easily changed or added. A security vulnerability exists in flusity CMS version v.2.33, which stems from issues that allow remote attackers to execute arbitrary code via the addpost.php component...

Huashi Private Cloud CDN Live Streaming Acceleration Server 安全漏洞

Huashi Private Cloud CDN Live Streaming Acceleration Server is a live streaming acceleration service from China Huashi. A security vulnerability exists in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport version v.1.1.2, which originates from a vulnerability that allow...

PT-2023-32429 · WordPress · Rtmedia

Name of the Vulnerable Software and Affected Versions: rtMedia for WordPress, BuddyPress and bbPress WordPress plugin versions prior to 4.6.16 Description: The issue concerns the rtMedia plugin's failure to validate uploaded files, potentially allowing attackers with low-privilege accounts to...

CVE-2023-48381

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...

CVE-2023-48965

An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file...

PT-2023-7576 · Unknown · Sticky Notes App Using Php With Source Code

Name of the Vulnerable Software and Affected Versions: Sticky Notes App Using PHP with Source Code version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This vulnerability can be exploited by a remote attacker to gain access to confidential information...

CVE-2023-46793

Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...

qdPM Code Issues Vulnerabilities

qdPM is a web-based open source project management tool. A security vulnerability exists in qdPM version 9.2, which stems from a remote code execution vulnerability. The vulnerability allows an attacker to upload a .php file to the /uploads URI via the Add Attachments function to execute remote...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

CSZ CMS 代码问题漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSKaza CSZ CMS version 1.2.2, which originates from a vulnerability that allows attackers to execute arbitrary commands and code via a crafted PHP file...

laravel-admin 代码问题漏洞

z-song laravel-admin is an administrative interface builder for the Laravel web development framework. A security vulnerability exists in laravel-admin v1.8.19, which stems from the existence of an arbitrary file upload vulnerability that can be exploited by an attacker to execute arbitrary code...

PT-2023-19069 · Erohtar · Dasherr

Name of the Vulnerable Software and Affected Versions: erohtar/Dasherr versions prior to 1.05.00 Description: The issue allows any unauthenticated user to execute arbitrary code on the server due to unrestricted file upload. The file /www/include/filesave.php enables uploading files to anywhere o...

yahoo YUI2 跨站脚本漏洞

YUI is a JavaScript and CSS library of YUI Library open source. yahoo YUI2 has a cross-site scripting vulnerability that originates from up.php sam.php renderhidden.php removechildren.php removeall.php readd.php overflow.php newnode2.php newnod has cross-site scripting vulnerability newnode2.php ...

CVE-2022-39179

College Management System v1.0 - Authenticated remote code execution. An admin user the authentication can be bypassed using SQL Injection that mentioned in my other report can upload .php file that contains malicious code via student.php file...

CVE-2022-43146

An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-26747 · Unknown · Restaurant Pos System

Name of the Vulnerable Software and Affected Versions: Restaurant POS System version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the add product.php file, which allows attackers to execute arbitrary code via a crafted PHP file. This can be achieved by...

PT-2022-22819 · Ucms · Ucms

Name of the Vulnerable Software and Affected Versions: UCMS version 1.6 Description: The issue allows for arbitrary file upload via the ucms/sadmin/file PHP file. Recommendations: For version 1.6, consider restricting access to the ucms/sadmin/file PHP file to minimize the risk of exploitation...