CVE-2022-25485

CuppaCMS v1.0 contains a Local File Inclusion in /alerts/alertLightbox.php via the url parameter. Affected component: CuppaCMS 1.0; root cause: insufficient input validation leading to LFI. Impact per sources: unauthorized access to sensitive files; potential remote code execution and system comp...

CVE-2022-25485

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php...

CVE-2022-25486

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php...

PT-2022-17320

Name of the Vulnerable Software and Affected Versions CuppaCMS version 1.0 Description The issue is related to a local file inclusion via the url parameter in the /alerts/alertLightbox.php endpoint. This allows for potential unauthorized access to local files. Recommendations For CuppaCMS version...

CVE-2022-25485: Inclusion of Functionality from Untrusted Control Sphere

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php...

CVE-2022-25486: Inclusion of Functionality from Untrusted Control Sphere

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

Command Injection

Overview libvcs is a vcs abstraction layer. Affected versions of this package are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get...

Cedar Gate EZ-NET Cross-Site Scripting Vulnerability

Cedar Gate EZ-NET is an Internet portal application from Cedar UK. A cross-site scripting vulnerability exists in The Cedar Gate EZ-NET 6.5.5, 6.6.3, 6.7.0, and 6.8.0 that stems from The Cedar Gate EZ-NET 6.5.5, and 6.8.0 having a call to display messages to the user that do not correctly clean u...

Cross site scripting

DISPUTED The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im referenc...

CVE-2022-23397: Improper Neutralization of Input During Web Page Generation

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

Formcraft3 < 3.8.28 - Unauthenticated SSRF

The plugin does not validate the URL parameter in the formcraft3get AJAX action, leading to SSRF issues exploitable by unauthenticated users PoC https://example.com/wp-admin/admin-ajax.php?action=formcraft3get=https://wpscan.com...

Agirhnet 1.0 Cross Site Scripting Vulnerability

Exploit Title: Agirhnet - Reflected XSS via GET Google Dork: inurl:agirhnet Exploit Author: Daniel Martinez Adan aDoN90 Vendor Homepage: https://agirh.net/ Version: app version 1.0 CVSS : 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N URL:...

D-Link Di-7200G Command Injection Vulnerability

D-Link Di-7200G is a gigabit enterprise router from D-Link, China.D-Link DI-7200GV2.E1 v21.04.09E1 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the url parameter...

MobiSoft MobiPlus security vulnerabilities

MobiSoft MobiPlus is a leading integrated solution for activities in the field of sales and distribution of MobiSoft Israel. MobiSoft MobiPlus suffers from a security vulnerability that originates from a MobiSoft user takeover and improper handling of url parameters. The vulnerability can be...

CVE-2021-25096

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...

Design/Logic Flaw

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...

PT-2022-9651

Name of the Vulnerable Software and Affected Versions IP2Location Country Blocker WordPress plugin versions prior to 2.26.5 Description The issue allows bans to be bypassed by using a specific parameter in the URL. Recommendations For versions prior to 2.26.5, update to version 2.26.5 or later to...

CVE-2022-0381

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...

Cross site scripting

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...