CVE-2024-27515

all versions

Osclass 5.1.2 is vulnerable to SQL Injection.

7.2HIGH

CVE-2016-10751

all versions

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code ex

7.2HIGH

CVE-2018-14481

all versions

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.

6.1MEDIUM

CVE-2014-8085

<= 3.4.2

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass

CVE-2014-8084

<= 3.4.2

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to in

CVE-2014-8083

<= 3.4.2

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrar

CVE-2014-6308

<= 3.4.1

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in th

CVE-2014-6280

<= 3.4.1

Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script

CVE-2012-5163

<= 2.3.4

Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbit

CVE-2012-5162

<= 2.3.4

Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitra

CVE-2012-1617

<= 2.3.5

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files

CVE-2012-0974

<= 2.3.4

Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass bef

CVE-2012-0973

<= 2.3.4

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sC