PT-2025-49183

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.65 Description An issue exists in Apache HTTP Server where improper neutralization of escape, meta, or control sequences can occur through environment variables set via the Apache configuration. Th...

PT-2025-49184

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.7 through 2.4.65 Description A flaw exists in Apache HTTP Server where a bypass of mod userdir+suexec is possible via the AllowOverride FileInfo functionality. Individuals with the ability to utilize the...

CVE-2023-5061: Missing Authorization

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the...

SUSE CVE-2008-1149

phpMyAdmin before 2.11.5 accesses $REQUEST to obtain some parameters instead of $GET and $POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery CSRF attacks by using crafted cookies...

SchoolCMS suffers from a variable override vulnerability (CNVD-2017-30716)

SchoolCMS is a school teaching management system based on PHP+MySQL. SchoolCMS suffers from a variable override vulnerability. An attacker can utilize the browser's TAB function to reset any user's password...

Variable Override Vulnerability in SchoolCMS

SchoolCMS is a school teaching management system based on PHP+MySQL. SchoolCMS suffers from a variable override vulnerability. An attacker can utilize the browser's TAB function to override access to user information...

Variable Override Vulnerability in DuomiCms_V1.32

DuomiCms is a specialized video-on-demand system. A variable override vulnerability exists in the common.php page of DuomiCms version 1.32. An attacker can exploit the vulnerability to cause arbitrary login in the background...

Theory PHP Common Vulnerabilities first bomb: installation problems-vulnerability warning-the black bar safety net

First get a copy of the source code, certainly is the first install, and the installation file will often appear problem. Generally the installation file after the installation is complete, basically not automatically delete the install file, I encountered will be automatically deleted if it...

MetInfo 5.3.1 存在变量覆盖漏洞(可重置管理员账号密码)

No description provided by source...

seacms variable override vulnerability

SeaCms is a set of applications for building online movies with PHP+MYSQL architecture. A global variable override vulnerability exists in seacms version 6.26. An attacker who successfully exploits this vulnerability can directly access the administration backend of the website...

phpshe v1.1 order.php 存在变量覆盖漏洞(导致可绕过付款)

No description provided by source...

Libsys图书管理系统 V5.5 变量覆盖漏洞

登陆页面 sessionstart ; if isset $REQUEST'username' $strUser = trim $REQUEST'username' ; $strInput = trim $REQUEST'passwd' ; $strMsg = "用户名或者密码错误"; switch $strUser case "opacadmin" : $strPassWd = $strPassWdFile; $strMsg = verifypwd $strInput, $strPassWd ; if $strMsg == true $SESSION'ADMINUSER' =...

DedeCMS 5.7 SP1 /install/index.php 远程文件包含漏洞

1.漏洞分析 /install/index.php.bak or index.php php $slang = 'utf-8'; $installdemoname = 'dedev57demo.txt'; $insLockfile = dirnameFILE.'/installlock.txt'; //初始化了变量 $moduleCacheFile = dirnameFILE.'/modules.tmp.inc';//初始化了变量 .... 29行 foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k =...

WordPress Plugin eShop Arbitrary Variable Override Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on servers with PHP and MySQL. eShop is an accessible shopping cart WordPress plugin. An arbitrary variable override vulnerability exists in...

ThinkSNS任意代码执行漏洞

简要描述： 代码执行漏洞 详细说明： 漏洞文件： /addons/widget/FeedListWidget/FeedlistWidget.class.php 漏洞函数： getData getData函数位于/addons/widget/FeedListWidget/FeedlistWidget.class.php 在第262行处调用renderFile函数进行渲染模版。 private function getData$var, $tpl = 'FeedList.html' $var'feedkey' = t$var'feedkey'; $var'cancomment' =...

c99 2.0 登录绕过漏洞

@extract$REQUEST"c99shcook";这行代码导致变量覆盖可以使得$login=0，直接登陆if $login if empty$md5pass $md5pass = md5$pass; if $SERVER"PHPAUTHUSER" != $login or md5$SERVER"PHPAUTHPW" != $md5pass if $logintxt === false $logintxt = ""; elseif empty$logintxt $logintxt = striptagseregreplace"nbsp;|br", " ", $donatedhtml;...

CommonSpot < 7.0.2 / 8.0.3 / 9.0.0 Multiple Vulnerabilities

According to its version number, the CommonSpot install hosted on the remote web server is affected by multiple vulnerabilities : - An access restriction bypass via a direct request. CVE-2014-2859 - Multiple cross-site scripting XSS vulnerabilities. CVE-2014-2860, CVE-2014-2861 - Improper...

phpcms 2007 onunload.inc.php update SQL注入漏洞

code!--?php defined'INPHPCMS' or exit'Access Denied'; $serverid ? 1 : showmessage$LANG'illegaloperation'; $db---query"UPDATE ".TABLEMOVIESERVER." SET num = num-1 WHERE serverid = $serverid AND num 0 "; 2 ?/code $serverid没有进行任何过滤也没有用单引号括起来，所以无视gpc。 核心文件include\common.inc.php里大概80左右变量覆盖漏洞。...

MetInfo 5.1 /include/common.php SQL注入漏洞

\include\common.inc.php代码第30行产生了变量覆盖漏洞，代码33行的$tablepre可以覆盖掉，所以导致SQL注入漏洞产生。 MetInfo 5.1...

[祝PKAV以及wooyun所有白帽子元旦快乐]anwsion缺陷大结合.

简要描述： foreach处理不当爆路径,程序设置缺陷,绕过全局变量的包含----变量覆盖 详细说明： 1.foreach处理不当爆路径 http://wenda.anwsion.com/search/ajax/searchresult/ 缺陷: searchresult AS $key = $val 代码没有检测$this-searchresult是否为空,是否没数组.... \wenda\views\default\inbox\readmessage.tpl.htm list AS $key = $val 缺陷一样. 2程序设置缺陷...