|
223111
|
9.8 |
CRITICAL
Network
|
jobberbase
|
jobberbase
|
In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection.
|
CWE-89
SQL Injection
|
CVE-2019-16125
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223112
|
9.8 |
CRITICAL
Network
|
youphptube
|
youphptube
|
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
|
CWE-862
Missing Authorization
|
CVE-2019-16124
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223113
|
7.5 |
HIGH
Network
|
kartatopia
|
piluscart
|
In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
|
CWE-22
Path Traversal
|
CVE-2019-16123
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223114
|
8.8 |
HIGH
Network
|
tri
|
event_tickets
|
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
|
CWE-1236
Improper Neutralization of Formula Elements in a CSV File
|
CVE-2019-16120
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223115
|
9.8 |
CRITICAL
Network
|
10web
|
photo_gallery
|
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
|
CWE-89
SQL Injection
|
CVE-2019-16119
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223116
|
6.1 |
MEDIUM
Network
|
10web
|
photo_gallery
|
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
|
CWE-79
Cross-site Scripting
|
CVE-2019-16118
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223117
|
6.1 |
MEDIUM
Network
|
10web
|
photo_gallery
|
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
|
CWE-79
Cross-site Scripting
|
CVE-2019-16117
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223118
|
7.8 |
HIGH
Local
|
glyphandcog
|
xpdfreader
|
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a cr…
|
CWE-125
Out-of-bounds Read
|
CVE-2019-16115
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223119
|
8.8 |
HIGH
Network
|
bludit
|
bludit
|
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.
|
CWE-22
Path Traversal
|
CVE-2019-16113
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
223120
|
5.3 |
MEDIUM
Network
|
plataformatec
|
devise
|
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation…
|
NVD-CWE-noinfo
|
CVE-2019-16109
|
2024-11-21 13:30 |
2019-09-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
