CVE-2024-53992 unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...

WordPress My Favorites Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software My Favorites Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37114 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1e94c277c4f6 Credits Jean Tirstan T Required privilege Contribut...

Remote Code Execution

magento/community-edition is vulnerable to Remote Code Execution. The vulnerability is due to unpatched security issues allowing unauthorized code execution and script injection...

Campcodes Online Event Management System SQL注入漏洞

Campcodes Online Event Management System is an online event management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Online Event Management System version 1.0, which originates from unknown code in /views/index.php that causes SQL injection via a parameter ID...

CVE-2024-3366 Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to...

Simple Art Gallery SQL注入漏洞

Simple Art Gallery is an art gallery application from Simple Art Gallery, Inc. A SQL injection vulnerability exists in Simple Art Gallery version 1.0, which stems from a problem in the file adminHome.php, where manipulation of the parameter socialfacebook can lead to sql injection...

GHSA-X6JF-C7WH-7M7W Trac Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2022-23808

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection...

Template Injection

thymeleaf-spring5 is vulnerable to template injection. An attacker can inject malicious input through the render function in AjaxThymeleafView.java, leading to remote code execution...

Cross Site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting. An attacker is able to inject and execute a malicious script by adding a blog and then editing an image file...

Prototye Pollution

putil-merge is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Mblog Cross-Site Scripting Vulnerability (CNVD-2021-26164)

Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 cross-site scripting vulnerability , an attacker can /settings/profile of the signature field to exploit the vulnerability to inject arbitrary Web script or HTML...

CVE-2020-7782 Command Injection

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

Prototype Pollution

y18n is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

PT-2020-12147 · Chadha · Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the sort parameter in the admin/manage-news.php file. This can lead to reflected XSS attacks. Recommendations: F...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

Responsive Realestate Script 3.2 - property-list?tbud SQL Injection

Responsive Realestate Script 3.2 - property-list?tbud SQL Injection Exploit Title: Responsive Realestate Script 3.2 - SQL Injection Dork: N/A Date: 09.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/responsive-realestate-script/...

ICDoctor Appointment 1.3 - key SQL Injection

ICDoctor Appointment 1.3 - key SQL Injection Exploit Title: Doctor Appointment Script 1.3 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/doctor-appointment-script.htm Demo:...

Dutch Auction Script 1.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Dutch Auction Script 1.2 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/dutch-auction-script.htm Demo:...

Unique Low Bid Auction Script 3.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Unique Low Bid Auction Script 3.3 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/unique-low-bid-auction-script.htm Demo:...