25 matches found
CVE-2026-100909
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...
PT-2026-99767
Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5 Description A remote server-side request forgery exists due to the manipulation of the realSourcePath argument within the...
EUVD-2007-2430
Malware in sbrugna...
PT-2022-25824
Name of the Vulnerable Software and Affected Versions Online Leave Management System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/leave system/classes/Master.php?f=delete department" endpoint. Recommendations For...
PT-2022-11271
Name of the Vulnerable Software and Affected Versions Sourcecodester Online Leave Management System version v1 Description The issue allows attackers to execute arbitrary SQL commands via the username parameter to the "/leave system/classes/Login.php" API endpoint. This enables attackers to...
CVE-2014-9702
system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information username and password via any request, such as a password reset request...
CVE-2014-9702: Insufficiently Protected Credentials
system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information username and password via any request, such as a password reset request...
PT-2020-7787
Name of the Vulnerable Software and Affected Versions: Cmfive versions through 2015-03-15 Description: The issue allows remote attackers to obtain sensitive information, including usernames and passwords, via any request, such as a password reset request, when database connectivity malfunctions...
CVE-2016-10510
Cross-site scripting XSS vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection mechanism in system/classes/Kohana/Security.php...
CVE-2016-10510: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection mechanism in system/classes/Kohana/Security.php...
PT-2017-7908
Name of the Vulnerable Software and Affected Versions Kohana versions prior to 3.3.6 Description A cross-site scripting XSS issue exists in the Security component, allowing remote attackers to inject arbitrary web script or HTML by bypassing the strip image tags protection mechanism in...
CVE-2012-1224: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
PT-2012-3147
Name of the Vulnerable Software and Affected Versions ContentLion Alpha version 1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the PATH INFO in system/classes/login.php. Recommendations For ContentLio...
javaws vulnerabilities
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...
Java Web Start vulnerable to execution of unauthorized system classes
Overview Java Web Start, included in the JRE Java Runtime Environment from Sun Microsystems and other products, contains a vulnerability allowing unauthorized execution of system classes. Java Web Start, included in the JRE Java Runtime Environment and other products, is a tool for distributing...
javaws vulnerabilities
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...
javaws vulnerabilities
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...
javaws vulnerabilities
Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...
GLSA-200706-08 : emul-linux-x86-java: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200706-08 emul-linux-x86-java: Multiple vulnerabilities Chris Evans of the Google Security Team has discovered an integer overflow in the ICC parser, and another vulnerability in the BMP parser. An unspecified vulnerability...
