220 matches found
CVE-2016-4864
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...
onArcade 2.4.x Local File Disclosure Vulnerability
Exploit for php platform in category web applications Exploit Title: onArcade 2.4.x Local File Get Contents Vulnerability Google Dork: inurl:"cup.php?a=all" Date: 23 Mar 2017 Exploit Author: Deyaa Muhammad Author Mail: contact at deyaa.me Exploit Blog:...
UBUNTU-CVE-2017-5613
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file...
Format string
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file...
CVE-2017-5613
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file...
74cms at the front Desk The type parameter template engine injection vulnerability
This is a service end template injection vulnerabilities. Application/Home/Controller/MController.class.php apply'Mobile' redirectbuildmobileurl; $type = I'get. type','android','trim'; $androiddownloadurl = C'qscmsandroiddownload'? C'qscmsandroiddownload':"; $iosdownloadurl = C'qscmsiosdownload'?...
eClinicalWorks Patient Portal SQL Injection Vulnerability (CNVD-2017-01321)
eClinicalWorks Patient Portal is a product for healthcare applications from eClinicalWorks, Inc. that provides patients with a secure means of communicating to view their Personal Health Record PHR, view lab results, and more. An SQL injection vulnerability exists in the template.jsp file in...
Cicada-known CMS v5. 6 user-deny-reflective XSS vulnerability
Vulnerability overview Cicada-known open source version of the CMS v5. 6 in the user module of the deny method to render the template file, for user input of parameters for rendering, and not handled correctly, can lead to bypassing some of the filter, thereby causing the reflective XSS the...
Huge-IT Slideshow Cross-Site Scripting Vulnerability
Huge-IT Slideshow is an extension developed by the Huge-IT team for use in Joomla! to attract visitors by improving the style and character of your website. Huge-IT Slideshow v1.0.4 in . /views/slideshow/tmpl/default.php file is vulnerable to cross-site scripting. The vulnerability can be exploit...
The vulnerability of the cgiPutts function on the CUPS printing server allows a hacker to inject any JavaScript or HTML code into the generated web interfaces.
The vulnerability in the cgiPutts function cgi-bin/template.c of the CUPS printing server is related to insufficient protection of the web page structure. Exploiting this vulnerability allows an attacker to inject arbitrary JavaScript or HTML code into the web pages generated by the system throug...
Mao10cms最新版前台注入(有条件限制)
简要描述： Mao10cms最新版前台注入 详细说明： Mao10cms用户量不小，2015-06-25更新的V3.5.2，今天来学习一下吧 这个注入问题出现在模板文件中，有多个地方引用这个模板，这里说3个漏洞，是这个问题文件中存在多个注入点引用这个出问题的文件。 问题文件在/theme/default/article/single.php,看代码 ;" " 无关代码 看到文件...
shopex485 最新后台拿webshell
简要描述： shopex485 最新后台拿webshell 详细说明： shopex485 最新后台拿webshell 测试版本：shopex485 日期：2014.8.25 漏洞证明： 页面管理-模板列表-模板文件管理，选择任意页面修改 保存两次，复制info.bak2.xml链接 http://127.0.0.1/shopex/shopadmin/index.php?ctl=system/tmpimage&act=recoverSource&p0=info.bak2.xml&p1=info.xml&p2=1354864820 info.xml修改为info.php...
DEBIAN-CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
UBUNTU-CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
Command injection
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file...
CVE-2012-3355
1 AlbumTab.py, 2 ArtistTab.py, 3 LinksTab.py, and 4 LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory...
CVE-2012-3355
1 AlbumTab.py, 2 ArtistTab.py, 3 LinksTab.py, and 4 LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory...