Remote code execution

Skycaiji v2.4 was discovered to contain a remote code execution RCE vulnerability via /SkycaijiApp/admin/controller/Develop.php...

CVE-2022-28096

Skycaiji v2.4 was discovered to contain a remote code execution RCE vulnerability via /SkycaijiApp/admin/controller/Develop.php...

CVE-2022-28096

Skycaiji v2.4 contains a remote code execution (RCE) vulnerability reachable via the /SkycaijiApp/admin/controller/Develop.php endpoint. Multiple connected sources (NVD, Red Hat, CP advisories) confirm the RCE via this path; no patch/version fix is specified in the provided documents. PT Security...

CVE-2022-28096

Skycaiji v2.4 was discovered to contain a remote code execution RCE vulnerability via /SkycaijiApp/admin/controller/Develop.php...

Cross site scripting

webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and...

CVE-2021-41918

webTareas

CVE-2021-33682

SAP Lumira Server 2.4 is affected by an XSS vulnerability due to insufficient encoding of user-controlled inputs. Attackers with basic (low) privileges can store a malicious script on the server, which would be executed for victims registered on SAP Lumira Server, potentially compromising confide...

Siemens License Management Utility

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: License Management Utility Vulnerability: Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could allow local users to escalate privileges. 3...

Arbitrary File Write Vulnerability in LaySNS v2.4

LaySNS is a lightweight, ThinkPHP+Layui-based integrated website management system that integrates content management and community interaction. LaySNS v2.4 has an arbitrary file write vulnerability that can be exploited by an attacker to write arbitrary files and gain control of the web server...

Security Bulletin: Multiple security vulnerabilities in IBM Business Process Manager affect IBM Cloud Orchestrator (CVE-2015-7407, CVE-2015-7400, CVE-2015-7454)

Summary IBM Business Process Manager that is bundled with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition, has identified multiple vulnerabilites. IBM Cloud Orchestrator V2.4, has addressed these vulnerabilites . It includes IBM Business Process Manager V8.5.6 CF2...

Security Bulletin: A security vulnerability has been identified in IBM Tivoli Monitoring shipped with IBM Cloud Orchestrator Enterprise (CVE-2015-1829, CVE-2015-3183, CVE-2015-1283, CVE-2015-4947, CVE-2015-2808)

Summary IBM Tivoli Monitoring is shipped as a component of IBM Cloud Orchestrator Enterprise Editon. Information about a security vulnerability affecting IBM Tivoli Monitoring has been published in a security bulletin. Vulnerability Details Review Security Bulletin: IBM Tivoli Monitoring...

CVE-2018-11470

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel...

Sql injection

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel...

CVE-2018-11470

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel...

CVE-2018-11372

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter...

Sql injection

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter...

Sql injection

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...

CVE-2018-11373

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...

CVE-2018-11372

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter...

CVE-2018-11372

CVE-2018-11372 affects iScripts eSwap v2.4. The issue is an SQL injection in the Wishlistdetailed.php User Panel ToId parameter, caused by unsafe handling of the ToId input. The vulnerability can enable attackers to view, add, modify, or delete data in the backend database (as described across mu...