Show filters
15 Total Results
Displaying 1-10 of 15
Sort by:
Attacker Value
Unknown
CVE-2016-10751
Disclosure Date: May 24, 2019 (last updated November 27, 2024)
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
0
Attacker Value
Unknown
CVE-2018-14481
Disclosure Date: January 03, 2019 (last updated November 27, 2024)
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.
0
Attacker Value
Unknown
CVE-2014-8085
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
0
Attacker Value
Unknown
CVE-2014-8084
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
0
Attacker Value
Unknown
CVE-2014-8083
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
0
Attacker Value
Unknown
CVE-2014-6308
Disclosure Date: October 20, 2014 (last updated October 05, 2023)
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
0
Attacker Value
Unknown
CVE-2014-6280
Disclosure Date: October 20, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php.
0
Attacker Value
Unknown
CVE-2012-5163
Disclosure Date: September 26, 2012 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
0
Attacker Value
Unknown
CVE-2012-5162
Disclosure Date: September 26, 2012 (last updated October 05, 2023)
Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
0
Attacker Value
Unknown
CVE-2012-1617
Disclosure Date: September 26, 2012 (last updated October 05, 2023)
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.
0
