ByteOS Network

Vulnerability Details :

CVE-2020-22474

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-22 Feb, 2021 | 16:07

Updated At-04 Aug, 2024 | 14:51

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:22 Feb, 2021 | 16:07

Updated At:04 Aug, 2024 | 14:51

▼CVE Numbering Authority (CNA)

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/	x_refsource_MISC

Hyperlink: https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/	x_refsource_MISC x_transferred

Hyperlink: https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:22 Feb, 2021 | 17:15

Updated At:21 Jul, 2021 | 11:39

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

weberp>>weberp>>4.15

cpe:2.3:a:weberp:weberp:4.15:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-829	Primary	nvd@nist.gov

CWE ID: CWE-829

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/	cve@mitre.org	Exploit Patch Third Party Advisory

Hyperlink: https://lyhinslab.org/index.php/2020/05/16/weberp-lfi/

Source: cve@mitre.org

Resource:

Exploit

Patch

Third Party Advisory

Similar CVEs

9Records found

CVE-2021-30121

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.25% / 47.73%

7 Day CHG~0.00%

Published-09 Jul, 2021 | 13:24

Updated-03 Aug, 2024 | 22:24

(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118

Vendor-kaseya n/a

Product-vsa n/a

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2013-4582

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.16% / 37.90%

7 Day CHG~0.00%

Published-28 Jan, 2020 | 15:17

Updated-06 Aug, 2024 | 16:45

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

Vendor-GitLab Inc.

Product-gitlab gitlab-shell GitLab Community Edition GitLab Enterprise Edition GitLab gitlab-shell

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2022-41216

Matching Score-4

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

View Details

Matching Score-4

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

CVSS Score-8.3||HIGH

EPSS-0.10% / 28.45%

7 Day CHG~0.00%

Published-22 Feb, 2023 | 14:42

Updated-20 Mar, 2025 | 17:01

Cloudflow - Local File Inclusion Vulnerability

Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system.

Vendor-hybridsoftware Hybrid Software

Product-cloudflow Cloudflow

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2022-37191

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-75.69% / 98.86%

7 Day CHG~0.00%

Published-13 Sep, 2022 | 22:07

Updated-03 Aug, 2024 | 10:21

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.

Vendor-cuppacms n/a

Product-cuppacms n/a

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2024-56216

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.18% / 39.84%

7 Day CHG~0.00%

Published-31 Dec, 2024 | 09:59

Updated-07 Feb, 2025 | 15:43

WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themify Themify Builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through 7.6.3.

Vendor-themify Themify

Product-builder Themify Builder

CWE ID-CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2022-29845

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-58.25% / 98.11%

7 Day CHG~0.00%

Published-11 May, 2022 | 17:55

Updated-27 Aug, 2024 | 17:48

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.

Vendor-n/a Progress Software Corporation

Product-whatsup_gold n/a

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2024-4359

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-6.5||MEDIUM

EPSS-0.59% / 68.08%

7 Day CHG~0.00%

Published-09 Aug, 2024 | 04:29

Updated-29 Jan, 2025 | 15:44

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2019-4263

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.13% / 33.64%

7 Day CHG~0.00%

Published-11 Jul, 2019 | 19:55

Updated-17 Sep, 2024 | 00:36

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.

Vendor-IBM Corporation

Product-content_navigator Content Navigator

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2020-5295

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.8||MEDIUM

EPSS-8.71% / 92.12%

7 Day CHG~0.00%

Published-03 Jun, 2020 | 21:50

Updated-04 Aug, 2024 | 08:22

Local File read vulnerability in OctoberCMS

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Vendor-octobercms octobercms

Product-october october

CWE ID-CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2020-22474

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs