CVE-2026-6956: Improper Neutralization of Input During Web Page Generation

ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported. Maintainers of this project were notified early...

DeShang DSO2O Access Control Error Vulnerability

DeShang DSO2O is a new retail e-commerce system from DeShang, China. An Access Control Error vulnerability exists in DeShang DSO2O version 4.1.0 and earlier, which stems from an unknown section in /install/install.php that results in incorrect access control...

CVE-2024-0358: Improper Access Control

A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ...

PT-2024-15493

Name of the Vulnerable Software and Affected Versions DeShang DSO2O versions up to 4.1.0 Description A critical issue has been found, affecting an unknown part of the file /install/install.php. This leads to improper access controls and can be initiated remotely. The exploit has been disclosed...

PT-2020-15168

Name of the Vulnerable Software and Affected Versions iCMS version 7 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other...

PT-2020-15188

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.14 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB NAME parameter to the "install/install.php" endpoint. This can potentially lead to the installation of malicious...

CVE-2020-19527: Improper Neutralization of Special Elements used in an OS Command

iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...

CVE-2020-15177

In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...

CVE-2020-15177: Improper Neutralization of Input During Web Page Generation

In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...

CVE-2019-7692: Improper Control of Generation of Code

install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder...

CVE-2018-20614: Improper Input Validation

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

CVE-2018-7271: Improper Control of Generation of Code

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...

CVE-2009-3508: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 class parameter to admin.php and the 2 url parameter to install/install.php; and allow remote authenticated administrators to read...

CVE-2007-1451: Undefined Security Weakness

GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" cleanup.php and then "Suppression des fichiers d'installation" delete.php...