CVE-2014-9219

CVE-2014-9219 CVE-2014-9219 XSS POC 关于 该漏洞由 phpMyAdmin 4.2.x 版本（4.2.13.1 之前）中 url.php 的重定向功能在处理 url 参数时的输入验证错误引起。远程攻击者可诱骗受害者访问特制链接，并在受害者的浏览器中，在易受攻击网站的安全上下文中执行任意 HTML 和脚本代码。 受影响版本 phpMyAdmin：4.2.0 - 4.2.13 问题 存在漏洞的代码使用 htmlspecialchars 来清除 URL 参数，然后将其插入 JavaScript 字符串上下文中： window.location='"...

EUVD-2016-7536

Malware in sbrugna...

CVE-2013-10070: Improper Neutralization of Directives in Dynamically Evaluated Code

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution...

CVE-2024-4963 D-Link DAR-7000-40 url.php unrestricted upload

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to initiate the attack remotel...

CVE-2024-4963 D-Link DAR-7000-40 url.php unrestricted upload

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to initiate the attack remotel...

CVE-2024-4963: Unrestricted Upload of File with Dangerous Type

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to initiate the attack remotel...

SUSE CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2017-20157

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to...

CVE-2017-20157

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to...

CVE-2017-20157: Server-Side Request Forgery (SSRF)

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to...

phpMyAdmin 4.4.0 < 4.4.15.1 / 4.5.0 < 4.5.1 Content Spoofing (PMASA-2015-5)

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.4.x prior to 4.4.15.1 or 4.5.x prior to 4.5.1. It is, therefore, affected by a content spoofing vulnerability. - The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x...

PT-2019-19852

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description A security issue was discovered, allowing unauthorized access to read any file in the system or scan the internal network without authentication. This is due to a call to wechat getxml in the...

YUNUCMS v1.0.7 Code Execution Vulnerabilities in controller\Wap.php and controller\Url.php Pages

YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. A code execution vulnerability exists in the YUNUCMS controller\Wap.php and controller\Url.php pages. An attacker can exploit the...

GLink Word Link Script 1.2.3 - SQL Injection

GLink Word Link Script 1.2.3 - SQL Injection Exploit Title: GLink Word Link Script v1.2.3 - SQL Injection Google Dork: N/A Date: 22.03.2017 Vendor Homepage: http://www.tufat.com/ Software: http://www.tufat.com/wp-content/uploads/sites/4/2015/zips/script131.zip Demo:...

CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

DEBIAN-CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6627

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6627: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...