Server side request forgery (ssrf)

iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery SSRF via the url parameter at admincp.php...

PT-2022-25893 · Icms · Icms

Name of the Vulnerable Software and Affected Versions: iCMS version 7.0.16 Description: A Server-Side Request Forgery SSRF issue was discovered, which can be exploited via the url parameter at the "admincp.php" endpoint. Recommendations: For iCMS version 7.0.16, avoid using the url parameter in t...

CVE-2022-41496: Server-Side Request Forgery (SSRF)

iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery SSRF via the url parameter at admincp.php...

ClipperCMS 代码问题漏洞

ClipperCMS is a content management system CMS from the ClipperCMS team. A security vulnerability exists in ClipperCMS version 1.3.3, which stems from the inclusion of server-side request forgery SSRF via the pkgurl parameter in /manager/index.php...

WordPress eCommerce Product Catalog 3.0.70 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

Cross site scripting

IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPPTEMPLATEFLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security...

Path traversal

Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete...

CVE-2022-39033

CVE-2022-39033 affects Smart eVision’s file acquisition function. The root cause is insufficient filtering of special characters in the URL parameter, enabling a path traversal vulnerability. An unauthenticated attacker can bypass authentication and access restricted paths to download and delete ...

CVE-2022-28977

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users t...

CVE-2022-38931

A Server-Side Request Forgery SSRF in fetchnetfileupload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter...

CVE-2022-38931: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in fetchnetfileupload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter...

PT-2022-6098 · Pdfkit · Pdfkit

Name of the Vulnerable Software and Affected Versions: pdfkit versions 0.0.0 through 0.8.7.2 Description: The issue is related to insufficient argument checking in the pdfkit library, which can be exploited by a remote attacker to execute arbitrary commands. This is a Command Injection...

JGraph draw.io 安全漏洞

JGraph draw.io is a configurable chart/whiteboard visualization application from JGraph. A security vulnerability exists in JGraph draw.io versions prior to 20.2.8, which stems from the proxy url parameter not being rate-limited...

CVE-2022-33149

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

CVE-2022-33149

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

CVE-2022-33149: Improper Neutralization of Special Elements used in an SQL Command

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

PT-2022-21711

Name of the Vulnerable Software and Affected Versions WWBN AVideo version 11.6 WWBN AVideo dev master commit 3f7c0364 Description A sql injection vulnerability exists in the ObjectYPT functionality, allowing an attacker to inject SQL by manipulating the url parameter. This issue is present in the...

CVE-2022-38357

Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/moduleframe/index.php...

PT-2022-24385 · Unknown · Eyes Of Network Web Application

Name of the Vulnerable Software and Affected Versions: Eyes of Network Web application affected versions not specified Description: The issue is related to the improper neutralization of special elements, making the Eyes of Network Web application susceptible to an iFrame injection attack. This...

Eyes of Network Web 注入漏洞

Eyes of Network Web is a global regulatory solution for hardware status of devices, operating systems, standard applications, business applications, and performance from the Eyes of Network Web community. A security vulnerability exists in Eyes of Network Web version 5.3 that originates in the ur...