CVE-2025-69212-PoC

CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — OS Command Injection via malicious .p7m filename in ZIP upload. File: src/Util/XML.php:100 — unsanitized $file in exec Vector: /plugins/importFEZIP/actions.php → ZIP → .p7m filename → exec"openssl smime ... -in...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the unentity method in src/PhpSpreadsheet/Reader/Xml.php, where HTML entities in XML...

CVE-2026-92932

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

PT-2026-94253

Name of the Vulnerable Software and Affected Versions sachertortephp affected versions not specified Description A logic error exists in the Xml::build static method within the lib/Cake/Utility/Xml.php file. The issue stems from incorrect operator precedence in a conditional statement intended to...

phpSysInfo CVE-2026-55584 - PSI_ALLOWED IP allowlist bypass (info disclosure)

CVE-2026-55584: phpSysInfo = 3.4.5 resolves the client IP from attacker-controlled X-Forwarded-For or Client-IP before REMOTEADDR when enforcing PSIALLOWED. Spoofing an allowlisted address bypasses the restriction and exposes full system information via xml.php. !/usr/bin/env python3 -- coding:...

WS-2023-0302

In phpsysinfo, the XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker, such as IP addresses, server names, network topologies, and other data that could be used to map out the internal...

CVE-2026-41936

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

CVE-2026-41936: Improper Restriction of XML External Entity Reference

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

CVE-2017-20212: Improper Limitation of a Pathname to a Restricted Directory

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unverified input parameters. Attackers can exploit the /var/www/data/controllers/api/xml.php readFile function to access...

CVE-2017-20212

The CVE-2017-20212 entry concerns FLIR Thermal Camera F/FC/PT/D firmware 8.0.0.64. Affected component: the web application path /var/www/data/controllers/api/xml.php, where readFile() reads local files without authentication. Root cause: unverified input parameters allow information disclosure. I...

EUVD-2009-4825

Malware in sbrugna...

GHSA-67GV-XRW7-P72W Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...

Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

CVE-2023-49006

Cross Site Request Forgery CSRF vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file...

phpSysInfo security vulnerability

phpSysInfo is phpSysInfo open source a customizable PHP script that does a great job of displaying information about your system. A security vulnerability exists in phpSysInfo version 3.4.3, which stems from a cross-site request forgery in XML.php...