CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25238
https://notcve.org/view.php?id=CVE-2022-25238
28 Jun 2022 — Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code. Silverstripe silverstripe/framework versiones hasta 4.10.0, permite un ataque de tipo XSS, dentro de las etiquetas de script que pueden ser añadidas al contenido del sitio web por medio de XHR por un usuario autenticado del CMS si el módu... • https://docs.silverstripe.org/en/4/changelogs/4.10.1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 5%CPEs: 2EXPL: 1CVE-2020-19316
https://notcve.org/view.php?id=CVE-2020-19316
20 Dec 2021 — OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. Una vulnerabilidad de inyección de comandos en el enlace de la función Filesystem.php en Laravel Framework versiones anteriores a 5.8.17 • http://www.netbytesec.com/advisories/OSCommandInjectionInLaravelFramework • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2021-43808 – Blade `@parent` Exploitation Leading To Possible XSS in Laravel
https://notcve.org/view.php?id=CVE-2021-43808
07 Dec 2021 — Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. • https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 47%CPEs: 1EXPL: 4CVE-2021-43617 – PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2021-43617
14 Nov 2021 — Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload. Laravel Framework hasta la versión 8.70.2 no bloquea suficientemente la subida de contenido PHP ejec... • https://www.exploit-db.com/exploits/50525 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7989
https://notcve.org/view.php?id=CVE-2020-7989
26 Jan 2020 — Adive Framework 2.0.8 has admin/user/add userUsername XSS. Adive Framework versión 2.0.8, presenta una vulnerabilidad de tipo XSS del userUsername de admin/user/add. • https://github.com/ferdinandmartin/adive-php7/blob/master/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7990
https://notcve.org/view.php?id=CVE-2020-7990
26 Jan 2020 — Adive Framework 2.0.8 has admin/user/add userName XSS. Adive Framework versión 2.0.8, presenta una vulnerabilidad de tipo XSS del userName de admin/user/add. • https://github.com/ferdinandmartin/adive-php7/blob/master/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 4CVE-2020-7991 – Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)
https://notcve.org/view.php?id=CVE-2020-7991
26 Jan 2020 — Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password. Adive Framework versión 2.0.8, presenta una vulnerabilidad de tipo CSRF de admin/config para cambiar la contraseña de Administrador. Adive Framework version 2.0.8 suffers from a cross site request forgery vulnerability. • https://packetstorm.news/files/id/156106 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0270
https://notcve.org/view.php?id=CVE-2015-0270
25 Oct 2019 — Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. Zend Framework versiones anteriores a 2.2.10 y versiones 2.3.x anteriores a 2.3.5, presenta una Inyección SQL Potencial en el adaptador Zend\Db de PostgreSQL. • https://framework.zend.com/security/advisory/ZF2015-02 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14987
https://notcve.org/view.php?id=CVE-2019-14987
13 Aug 2019 — Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. Adive Framework hasta la versión 2.0.7 se ve afectado por XSS en las funciones Create New Table y Create New Navigation Link • https://www.sevenlayers.com/index.php/231-adive-framework-2-0-7-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2013-20002 – Elemin < 1.4.3 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2013-20002
13 Nov 2013 — Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file. Elemin permite a atacantes remotos cargar y ejecutar código PHP arbitrario por medio del archivo wp-content/themes/elemin/themify/themify-ajax.php del framework Themify (versiones anteriores a 1.2.2) • https://en.0day.today/exploit/22090 • CWE-434: Unrestricted Upload of File with Dangerous Type •