CVE-2026-55072

Pimcore is an open-source Data & Experience Management Platform. In versions prior to 2026.1.5 , a missing trailing $ anchor in the ClassDefinition UID validation regex (ClassDefinition.php) combined with an unquoted $object->getClassId() concatenation in Block.php allows an authenticated user...

CVE-2026-55072: Improper Input Validation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

GHSA-2MHJ-FHVG-V428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

PT-2026-75915

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

CVE-2024-10505 wuzhicms block.php edit code injection

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2024-10505 wuzhicms block.php edit code injection

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2024-10505

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

WUZHI CMS 代码注入漏洞

WUZHI CMS is a PHP and MySQL based open source content management system CMS from WUZHI. A code injection vulnerability exists in WUZHI CMS version 4.1.0, which originates from a code injection in the add or edit function of the file www/coreframe/app/content/admin/block.php...

CVE-2024-10505: Improper Control of Generation of Code

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

PT-2024-38252 · Sourcecodester · Establishment Billing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Establishment Billing Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /manage block.php. The manipulation of the id argument leads to SQL injection...

CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...

PT-2015-3667

Name of the Vulnerable Software and Affected Versions TopicsViewer version 3.0 Beta 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to several API endpoints, including "edit block.php", "edit cat.php", "edit note.php", and...

IwebShop 2.4.13060700 /controllers/block.php SQL注入漏洞

No description provided by source...

King CMS 0.6.0 Remote File Inclusion

Securitylab.ir Application Info: Name: Kingcms Version: 0.6.0 Website: http://sourceforge.net/projects/kingcms Discoverd By: Securitylab.ir Website: http://securitylab.ir Contacts: adminatsecuritylab.ir & info@securitylabdotir Vulnerability Info: Type: Remote File Inclusion Vulnerability Risk: Hi...

CVE-2007-6615: Improper Control of Generation of Code

Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selectedprovider parameter...

CVE-2007-2665

The CVE-2007-2665 issue is a PHP remote file inclusion vulnerability in PhpFirstPost 0.1, exploitable via the Include parameter in block.php to execute arbitrary PHP code. Affected component is PhpFirstPost’s block.php; root cause is improper handling of a user-supplied URL in Include, enabling r...

CVE-2007-2665: Undefined Security Weakness

PHP remote file inclusion vulnerability in block.php in PhpFirstPost 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter...

PHP FirstPost 0.1 (block.php Include) Remote File Inclusion Exploit

No description provided by source. html head title..:: PhpFirstPost blog Remote File Include Exploit ::../title script language="JavaScript" / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir...

PHP FirstPost 0.1 - block.php?Include Remote File Inclusion

PHP FirstPost 0.1 - block.php?Include Remote File Inclusion ..:: PhpFirstPost blog Remote File Include Exploit ::.. / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir...