Moodle cross-site scripting vulnerability (CNVD-2018-02376)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in version 3.x of Moodle. A remote attacke...

Arbitrary File Download Vulnerability in Xingyunhai CMS v3.5

Xing Yunhai CMS XYHCMS is a completely open source CMS content management system, simple and easy to use. XYHCMS V3.5 version of the existence of arbitrary file download vulnerability, the attacker can be constructed through the parameters to download any file server , such as script code , servi...

Arbitrary File Deletion Vulnerability in Xingyunhai CMS v3.5

Xing Yunhai CMS XYHCMS is a completely open source CMS content management system, simple and easy to use. XYHCMS V3.5 version of the existence of arbitrary file deletion vulnerability, an attacker can use the vulnerability to delete any file , such as deleting install.lock for CMS reinstallation ...

Moodle Security Bypass Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in version 3.x of Moodle. An attacker could exploit th...

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-14096

A stored cross site scripting XSS vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable systems...

CVE-2017-14094

A vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an attacker to perform remote command execution via a cron job injection on a vulnerable system...

Code Execution Vulnerability in YzmCMS_v3.6

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A code execution vulnerability exists in YzmCMSv3.6. Allow attackers to exploit the vulnerability to execute script code and obtain...

CVE-2018-5377

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

gps-server.net GPS Tracking Software (self hosted) Remote Code Execution Vulnerability

gps-server.net GPS Tracking Software self hosted is a GPS location tracking program. The program is able to manage tracking history, reports, events, notifications and more. A security vulnerability exists in the 'writeLog' function in the fncommon.php file in gps-server.net GPS Tracking Software...

CVE-2018-3811

SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords function in smartgooglecode.php did not use prepared statements and did not sanitize...

Archon Cross-Site Scripting Vulnerability

Archon is a system of online catalog sites for manuscript collections at the Maine Maritime Museum. A cross-site scripting vulnerability exists in the packages/core/contact.php file in Archon version 3.21 rev-1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...

Cambium Networks ePMP Command Injection Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. A security vulnerability exists in Cambium Networks ePMP using firmware version 3.5 and prior, which stems from the We...

PHP Scripts Mall Readymade Video Sharing Script HTTP Injection Vulnerability

PHP Scripts Mall Readymade Video Sharing Script is a set of PHP based online video sharing website scripts by PHP Scripts Mall India. An HTML injection vulnerability exists in PHP Scripts Mall Readymade Video Sharing Script version 3.2. An attacker can exploit this vulnerability to inject HTML co...

Moodle Information Disclosure Vulnerability (CNVD-2017-37856)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. An information disclosure vulnerability exists in the Moodle 3.x version. An attacker can exploit this vulnerability to enumerate the...

DEBIAN-CVE-2017-16844

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than...

MSA vot.Ar 'parse' function unauthorized operation vulnerability

MSA vot.Ar is a suite of voting election applications. A security vulnerability exists in the 'parse' function in MSA vot.Ar version 3.1. An attacker in close physical proximity could exploit this vulnerability to cast multiple votes for a candidate with the help of a specially designed RFID voti...

Mailing List Manager Pro SQL Injection Vulnerability

Mailing List Manager Pro is an email marketing system. The system features mailing list building, address book editing and autoresponders. A SQL injection vulnerability exists in Mailing List Manager Pro version 3.0. A remote attacker can exploit the vulnerability by sending SQL injection command...

YxtCMF v3.1.0 SQL Injection Vulnerability in Frontend ShitiController.class.php Page

YxtCMF Yi Xue Tang Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. YxtCMF v3.1.0 has a SQL injection vulnerability in the frontend ShitiController.class.php page. An attacker can exploit this vulnerability to obtain sensitive...

LetoDMS SQL Injection Vulnerability (CNVD-2017-35203)

LetoDMS is a document management system based on PHP+MySQL development. A SQL injection vulnerability exists in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS before version 3.3.8, which can be exploited by remote attackers to execute arbitrary SQL commands...