CVE-2022-31201

SoftGuard Web SGW before 5.1.5 allows HTML injection...

Code injection

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI...

CVE-2022-34094

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via requesttoken.php...

CVE-2022-31583

The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31576

The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31528

The bonn-activity-maps/bamannotationtool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

bt_lnmp 路径遍历漏洞

btlnmp is a piaoyunsoft personal developer of a pagoda panel-based LNMP environment. btlnmp suffers from a path traversal vulnerability that stems from the failure of the Flask sendfile function to properly filter special elements in a resource or file path, which can be exploited by attackers to...

chainerrl-visualizer 路径遍历漏洞

chainerrl-visualizer is Chainer's open source way to visually analyze the behavior of ChainerRL agents to make debugging easier. chainerrl-visualizer suffers from a path traversal vulnerability that stems from a failure of the Flask sendfile function to properly filter the resource or file path f...

BookWyrm 跨站脚本漏洞

BookWyrm is a social reading platform. A cross-site scripting vulnerability exists in BookWyrm versions prior to 0.4.1, which stems from not properly cleaning up the html presented to the user, and is exploited by an attacker to perform cross-site scripting attacks...

CVE-2022-33043

CVE-2022-33043 affects Urtracker Premium, version 4.0.1.1477, with a cross-site scripting (XSS) flaw in the batch add function that can be triggered by a crafted Excel file to run arbitrary web scripts/HTML. Root cause details are not expanded beyond the XSS in the batch add flow in the available...

TrueConf Server 跨站脚本漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. TrueConf Server version 4.3.7 is vulnerable to a cross-site scripting vulnerability stemming from certain unknown processing of the file /admin/conferences/list/, where parameter ordering...

PortlandLabs Concrete Cms 安全漏洞

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. A remote code execution vulnerability exists in PortlandLabs Concrete Cms, which stems from the ability to download zip files over HTTP and execute from those zip files, which could be...

CVE-2022-32125

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /job...

74cms 跨站脚本漏洞

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology. 74cmsSE version v3.5.1 contains a cross-site scripting vulnerability that originates from the path /company/downresume/total/nature lack of data validation filtering of user-supplied data and output. An attacker...

74cms SQL注入漏洞

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from a lack of validation of externally entered SQL statements in the /home/job/map keyword parameter. An attacker could use this vulnerability to execute illega...

Zoo Management System 跨站脚本漏洞

Zoo Management System is a zoo management system. version 1.0 of Zoo Management System is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript cod...

letsmuseeum.com Cross Site Scripting vulnerability OBB-2659534

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hindu Matrimonial Script 安全漏洞

A security vulnerability exists in Hindu Matrimonial Script, an online matrimonial service website of PHP Matrimonial Script India, which stems from improper privilege management in /admin/generalsettings.php. No details of the vulnerability are currently available...

CVE-2018-25040 uTorrent Web HTTP RPC Server privileges management

A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HTTP RPC Server. The manipulation leads to privilege escalation. The attack can be launched remotely. The exploit has been disclosed to the publ...

InvenTree 跨站脚本漏洞

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A cross-site scripting vulnerability exists in InvenTree versions prior to 0.7.2, which stems from the application's lack of filtering and escapin...