CVE-2025-1791 Zorlan SkyCaiji Tool.php fileAction unrestricted upload

A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument savedata leads to unrestricted upload. The attack can be initiated...

CVE-2025-1791 Zorlan SkyCaiji Tool.php fileAction unrestricted upload

A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument savedata leads to unrestricted upload. The attack can be initiated...

PT-2025-9182 · Unknown · Zorlan Skycaiji

Name of the Vulnerable Software and Affected Versions: Zorlan SkyCaiji version 2.9 Description: A critical vulnerability was found in Zorlan SkyCaiji, affecting the previewAction function of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the data argument leads to...

CVE-2025-1791: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument savedata leads to unrestricted upload. The attack can be initiated...

PT-2018-13162

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.5.6 Description The issue allows reflected cross-site scripting, which can be exploited by remote unauthenticated attackers. This is achieved via the host parameter in the "api tool.php" API endpoint. Recommendations For...

CVE-2017-16514

Multiple persistent stored Cross-Site-Scripting XSS vulnerabilities in the files /wb/admin/admintools/tool.php Droplet Description and /install/index.php Site Title in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in t...

CVE-2017-16514: Improper Neutralization of Input During Web Page Generation

Multiple persistent stored Cross-Site-Scripting XSS vulnerabilities in the files /wb/admin/admintools/tool.php Droplet Description and /install/index.php Site Title in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in t...

PT-2018-6283

Name of the Vulnerable Software and Affected Versions: WebsiteBaker version 2.10.0 Description: The issue concerns multiple persistent stored Cross-Site-Scripting XSS vulnerabilities. These vulnerabilities are located in the files /wb/admin/admintools/tool.php, related to the Droplet Description,...

Cross site scripting

WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=usersearch...

CVE-2017-1000213

WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=usersearch...

PT-2017-10911

Name of the Vulnerable Software and Affected Versions WBCE version 1.1.11 Description The issue allows for reflected XSS attacks via the begriff POST parameter in the "/admin/admintools/tool.php?tool=user search" API endpoint. Recommendations For WBCE version 1.1.11, as a temporary workaround,...

CVE-2017-1000213: Improper Neutralization of Input During Web Page Generation

WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=usersearch...

PT-2017-13447

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb versions 5.1-0 Description The issue allows for local file inclusion via the tool list parameter also referred to as the url tool variable to the "module/tool all/select tool.php" endpoint. This can be...

PT-2017-13262

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface eonweb versions 5.1-0 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the host list parameter to "module/tool all/select tool.php". This is due to the improper...

CVE-2014-9243: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING to wb/admin/admintools/tool.php or 2 sectionid parameter to editmodulefiles.php, 3 news/addpost.php, 4 news/modifygroup.php, 5...

PT-2014-8898

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.8.3 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the QUERY STRING to "wb/admin/admintools/tool.php" or the section id parameter to several files in the...