Mars: ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration

A publicly accessible directory containing sensitive WordPress configuration files, including database credentials, authentication keys, and API secrets, was discovered. The vulnerability allowed unauthorized access to critical system information through a downloadable zip file. The security team...

CVE-2024-50801

A SQL Injection vulnerability exists in AbanteCart version 1.4.0 within the update() function of the public_html/admin/controller/responses/listing_grid/collections.php file. The flaw is exploitable via the id parameter. Practical consequences include potential unauthorized database access or man...

CVE-2023-48094

A cross-site scripting XSS vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /containerfiles/publichtml/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of...

CVE-2023-48094: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /containerfiles/publichtml/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of...

CVE-2023-46492

Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the publichtml/doc/index.html...

CVE-2023-46492

Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the publichtml/doc/index.html...

MLDB Security Vulnerabilities

MLDB is a machine learning database from MLDB, Inc. A security vulnerability exists in MLDB version v.2017.04.17.0. A remote attacker could exploit the vulnerability to execute arbitrary code via a specially crafted payload to publichtml/doc/index.html...

CVE-2023-46492: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the publichtml/doc/index.html...

Geeklog router.php cross-site scripting vulnerability

Geeklog is free and open source blogging software. A cross-site scripting vulnerability exists in Geeklog router.php due to an incorrect validation of user-supplied input by the publichtml/admin/router.php script. An attacker could exploit the vulnerability to steal the victim's cookie-based...

CVE-2022-4889: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...

Sql injection

A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file publichtml/ircupdater/svrrequestpub.php. The manipulation leads to sql injection. The patch is identified as...

CVE-2017-20169: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file publichtml/ircupdater/svrrequestpub.php. The manipulation leads to sql injection. The patch is identified as...

CVE-2022-31897: Improper Neutralization of Input During Web Page Generation

SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting XSS via publichtml/registervisitor?msg=...

CVE-2022-31914: Improper Neutralization of Input During Web Page Generation

Zoo Management System v1.0 is vulnerable to Cross Site Scripting XSS via zms/admin/publichtml/saveanimal?anid=24...

CVE-2022-27992

Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /publichtml/animals via the classid parameter...

CVE-2022-27992

Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /publichtml/animals via the classid parameter...

CVE-2022-27992

Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /publichtml/animals via the classid parameter...

PHPGURUKUL Zoo Management System SQL注入漏洞

PHPGURUKUL Zoo Management System is a zoo management system from the PHPGurukul Phpgurukul team. PHPGURUKUL Zoo Management System v1.0 is vulnerable to SQL injection, which stems from a lack of filtering in the classid parameter in /publichtml/animals, and can be exploited by attackers to execute...

CVE-2022-27351: Unrestricted Upload of File with Dangerous Type

Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /publichtml/applyvacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27992: Improper Neutralization of Special Elements used in an SQL Command

Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /publichtml/animals via the classid parameter...