#ExploitObserverAlert
CVE-2020-29555
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29555. The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
FIRST-EPSS: 0.000810000
NVD-IS: 5.2
NVD-ES: 2.8
ARPS-PRIORITY: 0.7616317
CVE-2020-29555
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29555. The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
FIRST-EPSS: 0.000810000
NVD-IS: 5.2
NVD-ES: 2.8
ARPS-PRIORITY: 0.7616317
#ExploitObserverAlert
CVE-2019-16686
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2019-16686. Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
FIRST-EPSS: 0.000580000
NVD-IS: 2.7
NVD-ES: 2.3
ARPS-PRIORITY: 0.7616317
CVE-2019-16686
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2019-16686. Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
FIRST-EPSS: 0.000580000
NVD-IS: 2.7
NVD-ES: 2.3
ARPS-PRIORITY: 0.7616317
#ExploitObserverAlert
CVE-2020-29553
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29553. The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
FIRST-EPSS: 0.001050000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.7616317
CVE-2020-29553
DESCRIPTION: Exploit Observer has 10 entries in 3 file formats related to CVE-2020-29553. The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
FIRST-EPSS: 0.001050000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.7616317
#ExploitObserverAlert
WLB-2024040064
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040064. Relate Learning And Teaching system Version before 2024.1 SSTI(Markup Sandbox function) lead to RCE.
ARPS-PRIORITY: 0.8504802
WLB-2024040064
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040064. Relate Learning And Teaching system Version before 2024.1 SSTI(Markup Sandbox function) lead to RCE.
ARPS-PRIORITY: 0.8504802
#ExploitObserverAlert
CVE-2023-25790
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2023-25790. Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
FIRST-EPSS: 0.000430000
ARPS-PRIORITY: 0.865513
CVE-2023-25790
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2023-25790. Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
FIRST-EPSS: 0.000430000
ARPS-PRIORITY: 0.865513
#ExploitObserverAlert
WLB-2024040065
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040065. FortiNet FortiClient EMS 7.2.2 / 7.0.10 SQL Injection / Remote Code Execution.
ARPS-PRIORITY: 0.8504802
WLB-2024040065
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040065. FortiNet FortiClient EMS 7.2.2 / 7.0.10 SQL Injection / Remote Code Execution.
ARPS-PRIORITY: 0.8504802
#ExploitObserverAlert
CVE-2019-16318
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2019-16318. In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
FIRST-EPSS: 0.001040000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9530071
CVE-2019-16318
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2019-16318. In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
FIRST-EPSS: 0.001040000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9530071
#ExploitObserverAlert
CVE-2018-11564
DESCRIPTION: Exploit Observer has 11 entries in 4 file formats related to CVE-2018-11564. Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.
FIRST-EPSS: 0.001790000
NVD-IS: 2.7
NVD-ES: 1.7
ARPS-PRIORITY: 0.8538082
CVE-2018-11564
DESCRIPTION: Exploit Observer has 11 entries in 4 file formats related to CVE-2018-11564. Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.
FIRST-EPSS: 0.001790000
NVD-IS: 2.7
NVD-ES: 1.7
ARPS-PRIORITY: 0.8538082
#ExploitObserverAlert
CVE-2022-3798
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3798. A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
CVE-2022-3798
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3798. A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
#ExploitObserverAlert
CVE-2020-12478
DESCRIPTION: Exploit Observer has 13 entries in 6 file formats related to CVE-2020-12478. TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
FIRST-EPSS: 0.014960000
NVD-IS: 3.6
NVD-ES: 3.9
ARPS-PRIORITY: 0.960217
CVE-2020-12478
DESCRIPTION: Exploit Observer has 13 entries in 6 file formats related to CVE-2020-12478. TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
FIRST-EPSS: 0.014960000
NVD-IS: 3.6
NVD-ES: 3.9
ARPS-PRIORITY: 0.960217
#ExploitObserverAlert
CVE-2018-12613
DESCRIPTION: Exploit Observer has 73 entries in 16 file formats related to CVE-2018-12613. An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
FIRST-EPSS: 0.974070000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.976755
CVE-2018-12613
DESCRIPTION: Exploit Observer has 73 entries in 16 file formats related to CVE-2018-12613. An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
FIRST-EPSS: 0.974070000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.976755
#ExploitObserverAlert
CVE-2022-3801
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3801. A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
CVE-2022-3801
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3801. A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
#ExploitObserverAlert
CVE-2020-13155
DESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-13155. clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.
FIRST-EPSS: 0.002170000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.851574
CVE-2020-13155
DESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-13155. clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.
FIRST-EPSS: 0.002170000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.851574
#ExploitObserverAlert
WLB-2024040062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040062. Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution.
ARPS-PRIORITY: 0.8504802
WLB-2024040062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024040062. Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution.
ARPS-PRIORITY: 0.8504802
#ExploitObserverAlert
CVE-2020-35136
DESCRIPTION: Exploit Observer has 11 entries in 4 file formats related to CVE-2020-35136. Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
FIRST-EPSS: 0.041880000
NVD-IS: 5.9
NVD-ES: 1.2
ARPS-PRIORITY: 0.7686529
CVE-2020-35136
DESCRIPTION: Exploit Observer has 11 entries in 4 file formats related to CVE-2020-35136. Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
FIRST-EPSS: 0.041880000
NVD-IS: 5.9
NVD-ES: 1.2
ARPS-PRIORITY: 0.7686529
#ExploitObserverAlert
CVE-2017-5594
DESCRIPTION: Exploit Observer has 11 entries in 6 file formats related to CVE-2017-5594. An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
FIRST-EPSS: 0.026670000
NVD-IS: 5.9
NVD-ES: 1.6
ARPS-PRIORITY: 0.8642072
CVE-2017-5594
DESCRIPTION: Exploit Observer has 11 entries in 6 file formats related to CVE-2017-5594. An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
FIRST-EPSS: 0.026670000
NVD-IS: 5.9
NVD-ES: 1.6
ARPS-PRIORITY: 0.8642072
#ExploitObserverAlert
CVE-2022-3799
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3799. A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
CVE-2022-3799
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2022-3799. A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.
FIRST-EPSS: 0.000930000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9586814
#ExploitObserverAlert
CVE-2022-3800
DESCRIPTION: Exploit Observer has 9 entries in 5 file formats related to CVE-2022-3800. A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
FIRST-EPSS: 0.051700000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9781971
CVE-2022-3800
DESCRIPTION: Exploit Observer has 9 entries in 5 file formats related to CVE-2022-3800. A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
FIRST-EPSS: 0.051700000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-PRIORITY: 0.9781971
#ExploitObserverAlert
CVE-2020-13156
DESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-13156. modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.
FIRST-EPSS: 0.001070000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-PRIORITY: 0.851574
CVE-2020-13156
DESCRIPTION: Exploit Observer has 8 entries in 4 file formats related to CVE-2020-13156. modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.
FIRST-EPSS: 0.001070000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-PRIORITY: 0.851574
#ExploitObserverAlert
CVE-2024-24785
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24785. If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
FIRST-EPSS: 0.000450000
ARPS-PRIORITY: 0.770344
CVE-2024-24785
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24785. If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
FIRST-EPSS: 0.000450000
ARPS-PRIORITY: 0.770344
#ExploitObserverAlert
CVE-2024-28847
DESCRIPTION: Exploit Observer has 9 entries in 5 file formats related to CVE-2024-28847. OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and, therefore, after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/events/subscriptions` which gets handled by `EventSubscriptionResource.createOrUpdateEventSubscription()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-251`.
FIRST-EPSS: 0.000440000
ARPS-PRIORITY: 0.7553561
CVE-2024-28847
DESCRIPTION: Exploit Observer has 9 entries in 5 file formats related to CVE-2024-28847. OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and, therefore, after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/events/subscriptions` which gets handled by `EventSubscriptionResource.createOrUpdateEventSubscription()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-251`.
FIRST-EPSS: 0.000440000
ARPS-PRIORITY: 0.7553561