GHSA-2F86-9CP8-6HCF Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Summary An authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the admin's bcrypt password hash and email, plus user/config/ with all site configuration. The download endpoint requires...

PT-2022-24279 · Esri · Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.9.1 and below Description: The issue allows a remote, unauthenticated attacker to traverse the file system and access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure o...

Local File Containment Vulnerability in KuaiFanCMS

KuaiFanCMS V5.x is developed with PHP5+MYSQL as the technical base. kf is built with Smarty template engine. A local file include vulnerability exists in the KuaiFanCMS /upload/index.php file. Due to the parameters within the include are not filtered, can lead to .class.php suffix file include, i...