RSS   Vulnerabilities for 'Pc4 uploader'   RSS

2009-06-23
 
CVE-2009-2180

CWE-22
 

 
Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) absolute path in the file parameter.

 
2009-05-20
 
CVE-2009-1742

CWE-89
 

 
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.

 


Copyright 2024, cxsecurity.com

 

Back to Top