Vulnerabilities

TI-2021-13233 CVE-2021-33949 · GHSA-gc7r-43fc-78q8

An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename…

HIGH 82

An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01045 Published 2023-02-17 No fix listed CWE-94

TI-2020-13311 CVE-2020-18106 · GHSA-7r8m-7fc4-jh8r

MEDIUM 44

The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00988 Published 2021-08-27 No fix listed CWE-89

TI-2020-13413 CVE-2020-18544 · GHSA-w7f6-9325-vv76

MEDIUM 47

SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php".

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02335 Published 2021-07-12 No fix listed CWE-89