Rejetto HTTP File Server 2.x, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities :

 - A SQL injection flaw exists in the 'mod_mysql_vhost' module where user input passed using the hostname is not properly sanitized. A remote attacker can exploit this to inject or manipulate SQL queries, resulting in the manipulation or disclosure of data. (CVE-2014-2323)

 - A traverse outside of restricted path flaw exists with the 'mod_evhost' and 'mod_simple_vhost' modules where user input passed using the hostname is not properly sanitized. A remote attacker can exploit this to gain access to potentially sensitive data. (CVE-2014-2324)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Roxy-WI is an open source Graphical User Interface (GUI) for managing HAProxy, Nginx, Apache and Keepalived servers. Roxy-WI versions before 6.1.1.0 suffer does not properly sanitize the `ipbackend` parameter on the `/app/options.py` endpoint, allowing a remote and unauthenticated attacker to achieve a remote code execution on the target instance.

The WordPress Fastest Cache Plugin installed on the remote host is affected by an unauthenticated SQL injection vulnerability:

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in access to local resources.

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers.

According to its self-reported version, the instance of SPIP CMS running on the remote web server is prior to 3.1.14 or 3.2.x prior to 3.2.8. It is, therefore, affected by multiples vulnerabilities : 
 - An SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters
 - A PHP code injection via the _oups parameter at /ecrire
 - HTML Injection in the component /spip.php.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number

According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x < 5.5.2 Patch Level 2, 5.5.3 < 5.5.3 Patch Level 2 or 5.5.4 < 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities :

 - A SQL injection vulnerability via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter

 - A remote code execution vulnerability via data[extension] and data[filedata] parameters within ajax/api/user/updateAvatar endpoint

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.8, 3.10.x prior to 3.10.5 or 3.11.x prior to 3.11.1. It is, therefore, affected by multiple vulnerabilities:

 - An SQL injection in the library fetching a user's enrolled courses. (CVE-2021-36392)

 - An SQL injection in the library fetching a user's recent courses. (CVE-2021-36393)

 - A Remote Code Execution (RCE) in the Shibboleth authentication plugin, when enabled. (CVE-2021-36394)

 - A recursion Denial of Service (DoS) in the file repository's URL parsing function. (CVE-2021-36395)

 - A blind Server-Side Request Forgery (SSRF) due to an insufficient redirect handling, leading to the bypass of cURL blocked hosts and allowed ports restrictions. (CVE-2021-36396)

 - An Insecure Direct Object Reference (IDOR) vulnerability allowing an user to delete other user messages. (CVE-2021-36397)

 - A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers displayed in the web service token list. (CVE-2021-36398)

 - A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers displayed in the quiz override screens. (CVE-2021-36399)

 - An Insecure Direct Object Reference (IDOR) vulnerability allowing an user to remove other users calendar URL subscriptions. (CVE-2021-36400)

 - A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers exported in HTML data formats being read locally. (CVE-2021-36401)

 - An improper input validation in user names of account confirmation emails leading leading to phishing risks. (CVE-2021-36402)

 - An improper input validation when processing email notifications containing HTML, leading to phishing risks. (CVE-2021-36403)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

Palo Alto PAN-OS versions 11.1.x < 11.1.0-h3 / 11.1.1-h1 / 11.1.2-h3, 11.0.x < 11.0.0-h3 / 11.0.1-h4 / 11.0.2-h4 / 11.0.3-h10 / 11.0.4-h1, 10.2.x < 10.2.0-h3 / 10.2.1-h2 / 10.2.2-h5 / 10.2.3-h13 / 10.2.4-h16 / 10.2.5-h6 / 10.2.6-h3 / 10.2.7-h8 / 10.2.8-h3 / 10.2.9-h1 suffer from an arbitrary file write vulnerability in the GlobalProtect feature, enabling a remote and unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.

ID	Name	Product	Family	Published	Updated	Severity
114299	Rejetto HTTP File Server 2.x Remote Code Execution	Web App Scanning	Component Vulnerability	6/14/2024	6/14/2024	critical
112358	lighttpd < 1.4.35 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	1/3/2024	critical
113953	Roxy-WI < 6.1.1.0 Remote Code Execution	Web App Scanning	Component Vulnerability	6/9/2023	6/9/2023	critical
114161	WP Fastest Cache Plugin for WordPress < 1.2.2 SQL Injection	Web App Scanning	Component Vulnerability	1/24/2024	1/24/2024	high
113214	Spring Cloud Function < 3.1.7 / 3.2.X < 3.2.3 Remote Code Execution	Web App Scanning	Component Vulnerability	3/31/2022	6/15/2022	critical
113427	Apache Commons Text Remote Code Execution (Text4Shell)	Web App Scanning	Component Vulnerability	11/10/2022	12/19/2022	critical
113848	SPIP CMS < 3.1.14 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	4/6/2023	4/6/2023	critical
98776	vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/12/2019	3/14/2023	critical
112932	Microsoft SharePoint Server 2019 < 16.0.10374.20000 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	8/31/2021	3/14/2023	high
113620	Moodle 3.10.x < 3.10.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
114282	Palo Alto PAN-OS GlobalProtect Remote Code Execution	Web App Scanning	Component Vulnerability	5/21/2024	5/21/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical

critical

critical

high

critical

critical