CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

CVE-2026-88623: Files or Directories Accessible to External Parties

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

EUVD-2026-82974

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-88623

The NUUO Network Video Recorder 2.0.0 is vulnerable to an arbitrary file read flaw located in the up.php component. The issue occurs because the application accepts a user-supplied url parameter via POST and uses the fopen() function to open the URL in binary read-only mode. The resulting content...

CVE-2023-46677 Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtuname' parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-46677

CVE-2023-46677 affects Online Job Portal v1.0. The vulnerability is described as multiple unauthenticated SQL injection flaws caused by the sign‑up.php resource not validating characters in the txt_uname parameter before sending data to the database. The CVSS metrics in the initial document class...

PT-2023-30156

Name of the Vulnerable Software and Affected Versions Online Job Portal version 1.0 Description The issue concerns an Unauthenticated SQL Injection vulnerability. Specifically, the txt uname parameter in the "sign-up.php" resource does not validate the input characters, which are then sent...

CVE-2023-46677: Improper Neutralization of Special Elements used in an SQL Command

Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtuname' parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-44824

An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component...

CVE-2023-44824: Unrestricted Upload of File with Dangerous Type

An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component...

CVE-2023-41575: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters...

CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

Arbitrary file deletion

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

PT-2022-18241

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the "/include/up.php" API endpoint. Recommendations For zbzcms version 1.0, as a temporary workaround,...

CVE-2022-27133: Undefined Security Weakness

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

Code injection

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...