Lvzc

A problematic issue has been found in the function test of the file coreframe/app/search/admin/config.php. The manipulation of the `sphinxhost`/`sphinxport` argument leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue has been found in the software, affecting some unknown functionality of the file /fladmin/cat edit.php. The manipulation of the `id` argument leads to SQL injection. This issue can be exploited remotely.

A critical issue has been found in the software, affecting an unknown functionality of the file /fladmin/login.php. The manipulation of the `username` argument leads to SQL injection. This issue can be exploited remotely.

A problem has been found in the software. It affects an unknown function of the file /fladmin/sysconfig doedit.php. The issue arises from the manipulation of the `info` argument, leading to cross-site scripting attacks. These attacks can be launched remotely.

A critical issue affects the processing of the file /fladmin/sysconfig doedit.php in the Backend component, leading to improper authorization. The attack can be initiated remotely.

A vulnerability has been found in the file /fladmin/jump.php, affecting unknown code. The manipulation of the `message/error` argument leads to cross-site scripting. The attack can be initiated remotely.

A critical vulnerability was found in the software, affecting an unknown part of the file /fladmin/user recoverpwd.php. The manipulation leads to the use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A cross-site scripting issue was found in the software, allowing for remote exploitation. The manipulation of the `name` argument in the "/;/admin/role/edit" file leads to this issue. Other parameters might also be affected. The exploit has been publicly disclosed, and the vendor was notified but did not respond.

A problem was found in the function `RestResponse` of the file `src/main/java/com/mysiteforme/admin/controller/system/SiteController`. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A critical vulnerability was found in ZeroWdd studentmanager, affecting the `addTeacher/editTeacher` function of the file `src/main/Java/com/wdd/studentmanager/controller/TeacherController.java`. The manipulation of the `file` argument leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue affects the `rememberMeManager` function in the file `src/main/java/com/mysiteforme/admin/config/ShiroConfig.java`. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A critical issue has been found in the file upload function of the `LocalUploadServiceImpl` class, located at `src/main/java/com/mysiteform/admin/service/ipl/`. The manipulation of the `test` argument leads to unrestricted file upload. This issue can be exploited remotely. The exploit has been made public.

A critical issue affects the `doContent` function of the file `src/main/java/com/mysiteform/admin/controller/system/FileController`. The manipulation of the `content` argument leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in ZeroWdd studentmanager, affecting the `submitAddRole` function of the file `src/main/java/com/zero/system/controller/RoleController.java`. The manipulation of the `name` argument leads to cross-site scripting. The attack can be initiated remotely.

A critical vulnerability was found in the Beijing Yunfan Internet Technology Yunfan Learning Examination System. The issue affects an unknown functionality of the file `src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl` of the JWT Token Handler component, leading to improper authentication. The attack can be launched remotely, with a rather high complexity, making exploitation difficult. The exploit has been disclosed to the public and may be used.

A problematic issue has been found in the Beijing Yunfan Internet Technology Yunfan Learning Examination System. It affects an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java, which is part of the Exam Answer Handler component. This issue leads to information disclosure and can be exploited remotely. The exploit has been made public.

A critical issue has been found in the system, affecting some unknown processing of the file `/doc.html`. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A critical vulnerability was found in Tongda OA, affecting unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulation leads to improper authorization, allowing remote attacks. The exploit has been disclosed to the public and may be used.

A critical issue has been found, affecting the `add/edit` function of the file `www/coreframe/app/content/admin/block.php`. This leads to code injection and can be exploited remotely. The issue has been publicly disclosed, and the vendor was contacted but did not respond.

A critical issue affects the processing of the file 3/Ebak5.1/upload/ChangeTable.php, where the manipulation of the `savefilename` argument leads to unrestricted upload. The attack can be initiated remotely.