Lorexxar

O Cacti é um framework de gerenciamento de desempenho e falhas de código aberto. Possui uma vulnerabilidade de injeção de SQL na função `get discovery results` do arquivo `automation devices.php` através do parâmetro `network`. Esta vulnerabilidade pode permitir que um atacante remoto execute código arbitrário.

Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the template function of host templates.php using the `graph template` parameter. This issue allows a remote attacker to execute arbitrary code due to inadequate protection of the SQL query structure.

O problema está relacionado à falta de proteção na estrutura da página da web, permitindo que um invasor remoto comprometa a integridade dos dados. Trata-se de uma vulnerabilidade de Cross Site Scripting (XSS), na qual um invasor pode explorar a vulnerabilidade por meio do host e do usuário do banco de dados no endpoint /installer/test.php.

O problema está relacionado a medidas de proteção insuficientes para as estruturas das páginas da web no Roundcube Webmail, permitindo que um invasor remoto comprometa a integridade dos dados. O problema está especificamente no objeto de modelo `username` em `include/rcmail output html.php`, o que permite ataques XSS.

O problema está relacionado a medidas de proteção insuficientes para as estruturas das páginas da web no Roundcube Webmail, permitindo que um invasor remoto comprometa a integridade dos dados. Existe uma vulnerabilidade de Cross-Site Scripting (XSS) por meio de um anexo XML malicioso, já que o formato text/xml está entre os tipos permitidos para visualização.

The issue allows remote PHP code execution due to a race condition in the `plupload action` function before deleting a file associated with the `name` parameter in `/wp-content/plugins/updraftplus/admin.php`. The vendor reports that this does not cross a privilege boundary.

The issue concerns a Server-Side Request Forgery (SSRF) in the `updraft ajax handler` function, located in `/wp-content/plugins/updraftplus/admin.php`, which can be exploited via an `httpget` subaction. The vendor has noted that this issue does not cross a privilege boundary.

The issue concerns a Cross Site Scripting (XSS) problem. It is located in the controllers/api.php file via the function parameter in a "c=api&m=data2" request.

The issue concerns remote PHP code execution via the `param` parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection.

The issue concerns a Cross Site Scripting (XSS) problem. It occurs in the admin/Login.php file when a specific payload is entered into the `username` field, provided the payload does not start with a '<' character.

The issue concerns a SQL Injection flaw. It can be exploited via the `num` parameter in requests to "libraries/Template.php" with either "action=related" or "action=tags".

The issue is related to SQL Injection, which can be exploited via the `catid` parameter in an "action=related" request to the "libraries/Template.php" endpoint.

The issue concerns a SQL Injection flaw. It can be exploited via the `field` parameter in requests to "libraries/Template.php" with specific actions such as "module", "member", "form", or "related".

The issue concerns URL Redirector Abuse via the `url` parameter in a sync action, related to the controllers/Weixin.php file.

The issue allows for XSS in visitors.php due to the lack of restriction on JavaScript in visited URLs, both during logging and when reading logs.

The issue allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action in the application/core/controller/images.php file.

A SQL Injection issue exists via the `visitor ip` parameter in the application/core/controller/excludes.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `folder`, `id`, or `name` parameter in the `/application/lib/ajax/get image.php` API endpoint.

The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to improper validation of user input in the `rangestart` and `rangeend` parameters on the "wps referrers page" page.