Server-Side Request Forgery (SSRF)

concrete5/concrete5 is vulnerable to server-side request forgery SSRF. The vulnerability exists in file.php because the server doesn't specify the validated IPs when downloading files which allows an attacker to access cloud and download files from the local network...

Server-Side Request Forgery (SSRF)

concrete5/concrete5 is vulnerable to server-side request forgery. The vulnerability exists through the local IP importing in 'file.php' which allows an attacker to read the files from private local LAN servers and exploit the local network apps...

Directory traversal

Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal...

CVE-2020-12764

CVE-2020-12764 affects Gnuteca 3.8, exposing a directory traversal in file.php?folder=/&file= that allows access to restricted paths. The description consistently states that the vulnerability arises from improper filtering of path elements, enabling traversal outside the intended directory. Publ...

CVE-2020-12764: Improper Limitation of a Pathname to a Restricted Directory

Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal...

CVE-2019-11537: Improper Neutralization of Input During Web Page Generation

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file...

WordPress RCE Vulnerability (CVE-2019-8942) - Windows

WordPress allows remote code execution RCE because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif...

Remote code execution

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

CVE-2016-10732: Improper Authentication

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

CVE-2018-10122: Improper Limitation of a Pathname to a Restricted Directory

QingDao Nature Easy Soft Chanzhi Enterprise Portal System aka chanzhieps pro1.6 allows remote attackers to read arbitrary files via directory traversal sequences in the pathname parameter to www/file.php...

Trend Micro Control Manager - ImportFile Directory Traversal RCE Exploit

Exploit for windows platform in category remote exploits require 'msf/core' require 'msf/core/exploit/phpexe' class MetasploitModule 'Trend Micro Control Manager importFile Directory Traversal RCE', 'Description' = %q This module exploits a directory traversal vulnerability found in Trend Micro...

CVE-2017-14396

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

Sql injection

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

CVE-2017-14396

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

CVE-2017-14396: Improper Neutralization of Special Elements used in an SQL Command

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

CVE-2017-5595: Exposure of Sensitive Information to an Unauthorized Actor

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

dedicatedmicros.com XSS vulnerability

Vulnerable URL: https://www.dedicatedmicros.com/europe/file.php?path=%3Cscript%3Ealert%28%27openbugbounty%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1280770 VIP website status:| No Check...

DesignFolio Plus Theme <= 1.2 - Arbitrary File Upload

Vulnerable File : upload-file.php...

CVE-2015-1172: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme aka holdingpattern 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...