An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1. If exploited, this vulnerability will allow attackers to obtain users' personally identifiable information including e-mail address and telephone numbers.
Max CVSS
7.5
EPSS Score
0.31%
Published
2021-05-21
Updated
2022-06-28
The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.
Max CVSS
7.5
EPSS Score
0.46%
Published
2018-10-29
Updated
2019-01-28
An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because del_action() in admin/model/database.class.php mishandles this parameter.
Max CVSS
7.5
EPSS Score
0.07%
Published
2018-10-23
Updated
2020-08-24
Multiple SQL injection vulnerabilities in PHPYun 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) provinceid parameter to search.php and the (2) e parameter to resumeview.php.
Max CVSS
7.5
EPSS Score
0.14%
Published
2011-04-27
Updated
2017-08-17
4 vulnerabilities found