Zorlu

The issue allows remote attackers to execute arbitrary code or cause a denial of service via a long string in a WAX file.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `robot` parameter in the `admin/robots.php` endpoint, specifically targeting the `formulaireRobot` function in `admin/robots.lib.php`.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `nom` or `user agent` parameters to the "admin/robots.php" endpoint.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators. The attack can be performed by sending a request to various API endpoints, including "filepath/yonetim/plugin/adminsave.php" to add an admin account, "ayarsave.php", "uyesave.php", "slaytadd.php", or "slaytsave.php" for unspecified impact.

A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `tarih` parameter in the `arsiv.asp` file.

The issue allows remote attackers to download a database due to insufficient access control. Sensitive information is stored under the web root, making it accessible via a direct request for data/guestbook.mdb.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `cid` parameter in the "shop.htm" endpoint.

The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the `pb username` (also known as `pb%5Fusername`) and `level` cookies.

The issue allows remote attackers to download a database due to insufficient access control. Sensitive information is stored under the web root, enabling attackers to access the database via a direct request for database/globepersonnel.mdb.

The issue allows remote attackers to execute arbitrary SQL commands via the `username` parameter in the authenticate.php file, which is related to login.php.

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo, then accessing it via a direct request to the file in authorphoto/. This is due to an unrestricted file upload vulnerability in user.modify.profile.php.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `lib` parameter when `register globals` is enabled. This is due to a PHP remote file inclusion vulnerability in the `lib/action/rss.php` file of the RSS module.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `start` parameter in the "index.php" file.

The issue allows remote attackers to bypass authentication and gain privileges. This is achieved by modifying specific cookies, namely `enombre` and `euri`.

Name of the Vulnerable Software and Affected Versions: X7 Chat version 2.0.5 Description: A SQL injection issue in the login page allows remote attackers to execute arbitrary SQL commands via the `password` field. Recommendations: For X7 Chat version 2.0.5, update the software to a version that fixes this issue, or as a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Realtor Classifieds System (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in `re images/`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Recipes Listing Portal (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo. This is done by accessing the uploaded file via a direct request to the file in the pictures/ directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ScriptsFeed Auto Classifieds (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo. This is done by accessing the uploaded file via a direct request to the file in the cars images/ directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: AlstraSoft SendIt Pro (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the `submit file.php` script, and then accessing it via a direct request to the file in the `send/files/` directory. Recommendations: For all affected versions, consider restricting access to the `submit file.php` script and the `send/files/` directory to prevent unauthorized file uploads and execution. As a temporary workaround, consider disabling the file upload functionality in `submit file.php` until a proper fix is applied.

Name of the Vulnerable Software and Affected Versions: PHPStore Complete Classifieds (affected versions not specified) Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in "classifieds1/yellow images/". Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.