19 matches found
CVE-2026-34787: Improper Control of Filename for Include/Require Statement in PHP Program
Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion LFI vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a requireonce path without proper sanitization. If the CSRF token check can ...
CVE-2025-61318: Path Traversal: '../filedir'
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature...
EUVD-2016-1275
Malware in sbrugna...
CVE-2025-44139: Unrestricted Upload of File with Dangerous Type
Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=uploadzip...
CVE-2025-25783: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...
CVE-2024-12843: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclos...
CVE-2023-44974: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2020-19028
File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function...
CVE-2020-19028: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function...
CVE-2020-21014
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php...
CVE-2020-21014
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php...
Arbitrary file deletion
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php...
CVE-2020-21014
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php...
CVE-2020-21014
CVE-2020-21014 affects emlog v6.0.0. The vulnerability is an arbitrary file deletion flaw in admin/plugin.php, arising from insufficient access restriction in the plugin deletion logic. Impact stated in sources is the ability to delete arbitrary files on the server. No exploit vectors or exploit ...
CVE-2020-21014: Undefined Security Weakness
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php...
CVE-2016-10105
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence...
CVE-2016-10105: Exposure of Sensitive Information to an Unauthorized Actor
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence...
CVE-2016-10083: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case...
CVE-2012-1039: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...