PT-2023-29572 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzzCMS version 2.1.9 Description: The issue allows a remote attacker to execute arbitrary code via a crafted file to the down url function in the zzz.php file. This enables the attacker to potentially gain control over the system...

PT-2023-27996 · Couchcms · Couchcms

Name of the Vulnerable Software and Affected Versions: CouchCMS version 2.3 Description: An open redirect issue exists in the sanitize url parameter, allowing attackers to redirect users to arbitrary websites via crafted URLs. Recommendations: For CouchCMS version 2.3, consider disabling the...

The vulnerability of the input[url] function in the application development environment and the Angular platform allows attackers to trigger a service failure.

The vulnerability of the inputurl function in the application development environment and the Angular platform is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

PT-2023-19474 · Mlecms · Mlecms

Name of the Vulnerable Software and Affected Versions: MLECMS version 3.0 Description: A critical issue affects the get url function in the library /upload/inc/lib/admin of the file uploadincincludecommon.func.php. The manipulation of the argument $ SERVER'REQUEST URI' leads to SQL injection. The...

WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF

The plugin does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks Put an internal/LAN URL such as below in the file upload by URL function https://127.0.0.1:8080...

GHSA-3HQ6-RMV7-39VH Injection in op-browser

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

Injection in op-browser

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

CVE-2021-40728

Adobe Acrobat Reader DC version 21.007.20095 and earlier, 21.007.20096 and earlier, 20.004.30015 and earlier, and 17.011.30202 and earlier is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

Unspecified Vulnerability in Flask-User

Flask-User is a software application. Customizable user authentication and user management, register, confirm, login, change username, password, forget password, etc. A security vulnerability exists in Flask-User, which can be exploited to bypass url authentication and redirect a user to an...

sunkaifei FlyCM 代码问题漏洞

sunkaifei FlyCms is sunkaifei open source application . A similar to Zhihu to Q&A based on the fully open source JAVA language development of social network building program . sunkaifei FlyCM has a security vulnerability , the vulnerability stems from ImagesService.java saveUrlAs function has a...

PT-2021-5825 · Unknown +8 · Hosted-Git-Info +8

Name of the Vulnerable Software and Affected Versions: hosted-git-info versions prior to 3.0.8 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the fromUrl function in index.js. This occurs due to the shortcutMatch regular expression, which exhibits polynomial...

Cross-Site Scripting (XSS)

prismJS is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the url function of Previewers plugin...

Op-browser Command Injection Vulnerability

op-browser is a module for opening browser windows and setting up proxies. A command injection vulnerability exists in op-browser 1.0.6 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary commands via the url function...

CVE-2020-7625

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

Command injection

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

CVE-2020-7625

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

CVE-2020-7625

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

PT-2020-19662

Name of the Vulnerable Software and Affected Versions op-browser versions 1.0.0 through 1.0.6 op-browser versions 1.0.7 through 1.0.9 Description The issue allows execution of arbitrary commands via the url function, enabling Command Injection attacks. Recommendations For versions 1.0.0 through...

CVE-2020-7625: Improper Neutralization of Special Elements used in an OS Command

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...