609 matches found
PT-2021-3489
Name of the Vulnerable Software and Affected Versions Machform versions prior to 16 Description The issue is related to insufficient sanitization of file attachments uploaded with forms through the upload.php endpoint. This allows for unauthenticated remote code execution. The vulnerability is...
PT-2021-3483
Name of the Vulnerable Software and Affected Versions Machform versions prior to 16 Description The issue arises from insufficient sanitization of file attachments uploaded with forms through the upload.php endpoint. This allows for stored cross-site scripting attacks. The vulnerability in the...
GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2021-45142)
GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/upload.php in GetSimple CMS version 3.3.16. The vulnerability can be exploited to conduct cross-site scripting attacks by adding comments to the...
GetSimple CMS Remote Code Execution Vulnerability (CNVD-2021-45301)
GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A remote code execution vulnerability exists in admin/upload.php in GetSimple CMS versions prior to 3.3.16. An attacker can exploit this vulnerability to achieve remote code execution via phar files...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
CVE-2021-28976
CVE-2021-28976 affects GetSimpleCMS versions prior to 3.3.16, with a remote code execution vulnerability in admin/upload.php exploitable through PHAR file uploads. The connected sources confirm a phar-based attack chain leading to RCE (e.g., PoCs and exploits in Exploit-DB/PacketStorm) and indica...
CVE-2021-28976: Unrestricted Upload of File with Dangerous Type
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
PT-2021-18011
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions prior to 3.3.16 Description: The issue is related to a Remote Code Execution vulnerability. It affects the admin/upload.php file through phar files. Recommendations: For versions prior to 3.3.16, update to version 3.3.16...
PT-2021-18012
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS version 3.3.16 Description: The issue concerns a Cross Site Scripting vulnerability. It can be exploited in the admin/upload.php file by adding comments or jpg and other file header information to the content of xla, pages, and...
CVE-2021-28977: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
PT-2021-3638
Name of the Vulnerable Software and Affected Versions Instant Images – One Click Unsplash Uploads WordPress plugin versions prior to 4.4.0.1 Description The issue is related to the improper validation and sanitization of the unsplash download w and unsplash download h parameter settings in the...
Group Office CRM Server-Side Request Forgery Vulnerability
Group Office CRM is an enterprise CRM and component tool with email client, shared projects, calendar, documents and more. A server-side request forgery vulnerability exists in Group Office CRM version 6.4.196, which can be exploited by a remote attacker to forge a GET request to any URL via the...
Server side request forgery (ssrf)
A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...