Code injection

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file...

Empire CMS Arbitrary PHP Code Execution Vulnerability

EmpireCMS is a free CMS Content Management System. A security vulnerability exists in EmpireCMS version 7.5. The vulnerability can be exploited by remote attackers to execute arbitrary PHP code via the 'ftemp' parameter on the enews=EditMemberForm page...