Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
osclass osclass vulnerabilities and exploits
(subscribe to this query)
7.2
CVSSv3
CVE-2016-10751
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
Osclass Osclass 3.6.1
6.1
CVSSv3
CVE-2018-14481
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.
Osclass Osclass 3.7.4
NA
CVE-2024-27515
Osclass 5.1.2 is vulnerable to SQL Injection.
NA
CVE-2014-8083
SQL injection vulnerability in the Search::setJsonAlert method in OSClass prior to 3.4.3 allows remote malicious users to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
Osclass Osclass
NA
CVE-2014-8084
Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass prior to 3.4.3 allows remote malicious users to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
Osclass Osclass
NA
CVE-2014-8085
Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass prior to 3.4.3 allows remote malicious users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct r...
Osclass Osclass
NA
CVE-2014-6280
Multiple cross-site scripting (XSS) vulnerabilities in OSClass prior to 3.4.2 allow remote malicious users to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/i...
Osclass Osclass
Osclass Osclass 3.4.0
NA
CVE-2014-6308
Directory traversal vulnerability in OSClass prior to 3.4.2 allows remote malicious users to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
Osclass Osclass
Osclass Osclass 3.4.0
1 EDB exploit
NA
CVE-2012-5162
Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass prior to 2.3.5 allow remote malicious users to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
Osclass Osclass
NA
CVE-2012-5163
Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass prior to 2.3.5 allows remote malicious users to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
Osclass Osclass
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
authentication bypass
CVE-2024-30043
camera
CVE-2023-40404
CVE-2024-2793
client side
CVE-2024-4469
CVE-2024-3565
CVE-2024-29825
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »