47 matches found
CVE-2026-55584
CVE-2026-55584 - phpSysInfo IP 허용 목록 우회 CWE-290, CVSS 7.5 높음, phpSysInfo = 3.4.5 참조: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED는 REMOTEADDR로 폴백하기 전에 공격자가 제어하는 X-Forwarded-For그다음 Client-IP 헤더에서 클라이언트 IP를 결정합니다. 신뢰할 수 있는 프록시 개념이 없으므로, 허용된 IP를 스푸핑하면 허용 목록을 무력화하고 xml.php를 통해 전체 시스템 정보가 노출됩니다. PoC:...
CVE-2025-69212-PoC
CVE-2025-69212 — OpenSTAManager P7M 명령 주입 PoC OpenSTAManager = 2.9.8 — 악성 .p7m 파일명을 통한 ZIP 업로드 OS 명령 주입 파일: src/Util/XML.php:100 — exec에서 비정화된 $file 벡터: /plugins/importFEZIP/actions.php → ZIP → .p7m 파일명 → exec"openssl smime ... -in "$file" ..." 사용법 리스너 nc -lvnp 4444 익스플로잇 python3...
PT-2026-94253
Name of the Vulnerable Software and Affected Versions sachertortephp affected versions not specified Description A logic error exists in the Xml::build static method within the lib/Cake/Utility/Xml.php file. The issue stems from incorrect operator precedence in a conditional statement intended to...
CVE-2026-41936: Improper Restriction of XML External Entity Reference
Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...
CVE-2017-20212: Improper Limitation of a Pathname to a Restricted Directory
FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile function to access...
CVE-2017-20212
The CVE-2017-20212 entry concerns FLIR Thermal Camera F/FC/PT/D firmware 8.0.0.64. Affected component: the web application path /var/www/data/controllers/api/xml.php, where readFile() reads local files without authentication. Root cause: unverified input parameters allow information disclosure. I...
EUVD-2009-4825
Malware in sbrugna...
GHSA-67GV-XRW7-P72W Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
CVE-2023-49006 affects Phpsysinfo 3.4.3 and is a Cross-Site Request Forgery (CSRF) vulnerability. The claim states that a crafted page in XML.php can cause a remote attacker to obtain sensitive information. Affected component is Phpsysinfo (XML.php as the attack surface); root cause is CSRF, enab...
phpSysInfo security vulnerability
phpSysInfo is phpSysInfo open source a customizable PHP script that does a great job of displaying information about your system. A security vulnerability exists in phpSysInfo version 3.4.3, which stems from a cross-site request forgery in XML.php...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
CVE-2023-49006
Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...
XML.php JSONP hijacking
Description The XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker. Proof of Concept We created an HTML file as a proof of concept to showcase the vulnerability. This HTML file will...