CVE-2021-26752

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

CVE-2020-10450

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-traffic.php by adding a question mark ? followed by the payload...

CVE-2020-10450

CVE-2020-10450 affects Chadha PHPKB Standard Multi-Language 9. The issue is a Reflected XSS in URIs handled by admin/header.php, exploitable via admin/report-traffic.php by appending a question mark and a payload. The Red Hat entries corroborate the same underlying vulnerability in related pages ...

Command injection

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...

CVE-2018-20727

CVE-2018-20727 affects NeDi prior to 1.7Cp3. The vulnerability allows authenticated users to perform server-side command execution via user-controlled parameters: flt (Nodes-Traffic.php), dv (Devices-Graph.php), or tit (drawmap.php). This is a command-injection flaw arising from insufficient inpu...

Traq 2.3.5 CSRF / XSS / SQL Injection Vulnerability

Exploit for php platform in category web applications ==================================================================== Vulnerable Software: traq-2.3.5 Official Site: TraqProject.org ==================================================================== About Software: Traq is a PHP powered...

CVE-2006-1289

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 password, 3 team, 4 level, 5 status, 6 teamname, and 7 teamlead parameters in a auth.php; the 8 username, 9 action, and 10 filter...

Sql injection

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 password, 3 team, 4 level, 5 status, 6 teamname, and 7 teamlead parameters in a auth.php; the 8 username, 9 action, and 10 filter...