167 matches found
PT-2019-11480
Name of the Vulnerable Software and Affected Versions: zzcms versions 8.3 and earlier Description: The issue concerns a File Delete to Code Execution problem. It affects the user/licence save.php component. Recommendations: For zzcms versions 8.3 and earlier, update to a version later than 8.3 to...
Laravel SQL Injection Vulnerability
Laravel Framework is a PHP-based web application development framework developed by Taylor Otwell Software Developers. A SQL injection vulnerability exists in the save.php file in Laravel version 5.4.15. The vulnerability can be exploited by a remote attacker to execute arbitrary SQL commands wit...
Sql injection
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhxuser and dhxversion parameters...
CVE-2018-6330
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhxuser and dhxversion parameters...
CVE-2018-6330
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhxuser and dhxversion parameters...
CVE-2018-6330
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhxuser and dhxversion parameters...
PT-2019-11018
Name of the Vulnerable Software and Affected Versions: Laravel version 5.4.15 Description: The issue concerns Error based SQL injection. It is exploitable via the dhx user and dhx version parameters in the save.php file. Recommendations: For Laravel version 5.4.15, consider restricting access to...
CVE-2018-6330: Improper Neutralization of Special Elements used in an SQL Command
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhxuser and dhxversion parameters...
PT-2019-19420
Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.6.1 Description The issue allows for PHP code injection through a CSRF attack. This is achieved by sending a request to the "/admin015/save.php?act=editfile" endpoint, where an attacker can provide a filename in the fil...
CVE-2019-9182: Cross-Site Request Forgery (CSRF)
There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter...
PT-2018-15260
Name of the Vulnerable Software and Affected Versions zzzphp cms version 1.5.8 Description An issue was discovered that allows remote attackers to delete arbitrary files. This is possible due to the del file function in the /admin/save.php endpoint, which can be exploited by using a mixed-case...
CVE-2018-19168
Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...
CVE-2018-19168: Improper Neutralization of Special Elements used in an OS Command
Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...
CVE-2018-19168
Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...
PT-2018-14838
Name of the Vulnerable Software and Affected Versions FruityWifi versions through 2.4 Description The issue allows remote attackers to execute arbitrary code with root privileges via a crafted mod name parameter in a POST request to the "/www/modules/save.php" API endpoint. This can be exploited...
CVE-2018-13024
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
CVE-2018-13024
MetInfo v6.0.0 is affected by a remote code execution vulnerability that allows an attacker to write PHP code to a file via the module parameter to admin/column/save.php in an editor upload action. Affected component: MetInfo CMS, version 6.0.0. The underlying issue is the ability to write to a ....
CVE-2018-13024: Unrestricted Upload of File with Dangerous Type
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
PT-2018-11544
Name of the Vulnerable Software and Affected Versions Metinfo version 6.0.0 Description The issue allows remote attackers to write and execute code via the module parameter to "admin/column/save.php" in an editor upload action. Recommendations For Metinfo version 6.0.0, consider restricting acces...