Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown

CVE-2016-10731

Disclosure Date: October 29, 2018 (last updated November 27, 2024)
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
0
0
Attacker Value
Unknown

CVE-2016-10734

Disclosure Date: October 29, 2018 (last updated November 27, 2024)
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
0
0
Attacker Value
Unknown

CVE-2016-10733

Disclosure Date: October 29, 2018 (last updated November 27, 2024)
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
0
0
Attacker Value
Unknown

CVE-2016-10732

Disclosure Date: October 29, 2018 (last updated November 27, 2024)
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
0
0