RSS   Vulnerabilities for 'Youphptube'   RSS

2021-11-01
 
CVE-2021-25874

CWE-89
 
 
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.

 
 
CVE-2021-25875

CWE-79
 
 
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

 
 
CVE-2021-25876

CWE-79
 
 
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

 
 
CVE-2021-25877

CWE-732
 
 
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.

 
 
CVE-2021-25878

CWE-79
 
 
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

 
2019-09-08
 
CVE-2019-16124

CWE-269
 
 
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.

 
2019-08-20
 
CVE-2019-14430

CWE-89
 
 
plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.

 

Copyright 2024, cxsecurity.com

 

Back to Top