CVE-2024-24520: Improper Control of Generation of Code

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place...

CVE-2024-24520

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file located in the languages directory. This vulnerability is categorized as Improper Control of Generation of Code . As a temporary workaround, it is recommended to restrict access to the upgrad...

CVE-2024-24520

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place...

CVE-2024-24520

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place...

Lepton CMS 7.0.0 Remote Code Execution Vulnerability

Exploit Title: LeptonCMS Version : 7.0.0 Remote Code Execution Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://www.lepton-cms.com/ Version : 7.0.0 Tested on: https://www.softaculous.com/apps/cms/LEPTON 1 Login with admin cred https://127.0.0.1/LEPTON/backend/login/index.php 2 G...

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Directory Traversal File Write Exploit

Summary The SOUND4 IMPACT introduces an innovative process - mono and stereo parts of the signal are processed separately to obtain perfect consistency in terms of both sound and level. Therefore, in moving reception, when the FM receiver switches from stereo to mono and back to stereo, the sound...

Cross-site Scripting (XSS) - Reflected in yourls/yourls

✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...

CVE-2021-27811

A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of clientupgradeedition.php and Upgrade.php...

PT-2021-3652

Name of the Vulnerable Software and Affected Versions QibosoftX1 version 1.0 Description A code injection issue has been found in the Upgrade function, related to incorrect code generation management in components such as client upgrade edition.php and Upgrade.php. This allows an attacker to...

CVE-2021-27811: Improper Control of Generation of Code

A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of clientupgradeedition.php and Upgrade.php...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

Server side request forgery (ssrf)

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534

CVE-2020-23534 is a server-side request forgery (SSRF) vulnerability affecting gopeak masterlab 2.1.5, exploitable via the 'source' parameter in Upgrade.php. The connected records confirm this specific vulnerable component and parameter; no additional exploit details, affected versions beyond 2.1...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

PT-2021-10907

Name of the Vulnerable Software and Affected Versions gopeak masterlab version 2.1.5 Description A server-side request forgery SSRF issue exists due to the source parameter in Upgrade.php. This allows for potential unauthorized access to internal resources. Recommendations For gopeak masterlab...

CVE-2019-18219: Improper Neutralization of Input During Web Page Generation

Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...

PT-2019-15284

Name of the Vulnerable Software and Affected Versions Sitemagic CMS version 4.4.1 Description The issue is related to a Cross-Site-Scripting XSS vulnerability due to the failure to validate user input. This allows for JavaScript injection within both GET or POST requests. The affected components...