CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 4CVE-2021-43617 – PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload. Laravel Framework hasta la versión 8.70.2 no bloquea suficientemente la subida de contenido PHP ejecutable porque Illuminate/Validation/Concerns/ValidatesAttributes.php carece de una comprobación para los archivos .phar, que se manejan como application/x-httpd-php en sistemas basados en Debian. NOTA: este registro CVE es para Laravel Framework, y no está relacionado con ningún informe sobre aplicaciones de usuario escritas incorrectamente para la carga de imágenes • https://www.exploit-db.com/exploits/50525 https://github.com/kombat1/CVE-2021-43617 https://github.com/Sybelle03/CVE-2021-43617 https://github.com/aweiiy/CVE-2021-43617 https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333 https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0270
https://notcve.org/view.php?id=CVE-2015-0270
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. Zend Framework versiones anteriores a 2.2.10 y versiones 2.3.x anteriores a 2.3.5, presenta una Inyección SQL Potencial en el adaptador Zend\Db de PostgreSQL. • https://framework.zend.com/security/advisory/ZF2015-02 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •