CVE-2026-78435: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2024-51092: Improper Neutralization of Special Elements used in an OS Command

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

CVE-2026-5561: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of the file app/Http/Controllers/SettingsController.php of the component Environment Variable Handler. Executing a manipulation can lead to injection. It is...

Stored Cross-Site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to adding media segment in the videoThumbnailUpdateAction function in SettingsController.php which allows an attacker to inject and execute JavaScript in the browser when viewing the video...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of input sanitization in the file upload in the SettingsController.php file allowing an attacker to bypass the system using an event handler...

CVE-2021-45364

A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product...

CVE-2021-45364

A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product...

Remote code execution

DISPUTED A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product...

CVE-2021-45364

CVE-2021-45364 affects Statamic up to version 3.2.26 via SettingsController.php, described as a Code Execution vulnerability. The vendor states there was an error publishing this CVE record and that the affected code was not used in any Statamic product, which is echoed by multiple sources (inclu...