252 matches found
EUVD-2018-2046
Malware in sbrugna...
EUVD-2024-35319
Malicious code in bioql PyPI...
EUVD-2022-44670
Malicious code in bioql PyPI...
EUVD-2023-51511
Malicious code in bioql PyPI...
CVE-2011-10011
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remot...
CVE-2011-10011
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remot...
CVE-2011-10011
CVE-2011-10011 affects WeBid 1.0.2. The vulnerability is a remote PHP code injection in converter.php: unsanitized input from the to parameter of a POST request is written to includes/currencies.php, allowing an unauthenticated attacker to inject arbitrary PHP code and achieve persistent remote c...
CVE-2011-10011
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remot...
CVE-2011-10011 WeBid 1.0.2 converter.php Remote PHP Code Injection
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remot...
CVE-2011-10011 WeBid 1.0.2 converter.php Remote PHP Code Injection
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remot...
Sourceforge WeBid 安全漏洞
Sourceforge WeBid is a Sourceforge open source web project for online auctions and selling products. A security vulnerability exists in Sourceforge WeBid version 1.0.2, which stems from a converter.php script that does not clean up the to parameter in a POST request, which could lead to remote co...
PT-2025-33080 · Webid · Webid
Name of the Vulnerable Software and Affected Versions: WeBid version 1.0.2 Description: WeBid version 1.0.2 contains a remote code injection issue in the convert.php script. Unsanitized input from the to parameter in a POST request is directly written to the includes/currencies.php file. This...
CVE-2024-32166
Webid v1.2.1 suffers from an Insecure Direct Object Reference IDOR - Broken Access Control vulnerability, allowing attackers to buy now an auction that is suspended horizontal privilege escalation...
CVE-2023-47397
WeBid =1.2.2 is vulnerable to code injection via admin/categoriestrans.php...
CVE-2022-41477
A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...
CVE-2020-23359
WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check...
CVE-2014-5101
Multiple cross-site scripting XSS vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 TPLname, 2 TPLnick, 3 TPLemail, 4 TPLyear, 5 TPLaddress, 6 TPLcity, 7 TPLprov, 8 TPLzip, 9 TPLphone, 10 TPLppemail, 11 TPLauthnetid, 12 TPLauthnetpass, 13...
CVE-2014-5114
WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...
CVE-2011-3815
WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files...