155 matches found
CVE-2014-5187: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the Tom M8te tom-m8te plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php...
OpenDock Easy Doc <= 1.4 - (doc_directory) File Include Vulnerabilities
No description provided by source. ECHOADV49$2006 ----------------------------------------------------------------------------------------------- ECHOADV49$2006OpenDock Easy Doc =1.4 docdirectory Multiple Remote File Inclusion Vulnerability...
CMS Mini <= 0.2.2 - Remote Command Execution Exploit
No description provided by source. --+++================================================================+++-- --+++====== CMS Mini = 0.2.2 Remote Command Execution Exploit ======+++-- --+++================================================================+++-- ?php function usage exit \nCMS Mini =...
V-webmail 1.6.4 includes/pear/File.php CONFIG[pear_dir] Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/30162/info V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and t...
WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution
No description provided by source. ============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted...
limesurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion Vulnerability
No description provided by source. Owner : Pr0T3cT10n Email : [email protected] Homepage : www.kamikaz-team.com Script site : www.limesurvey.org Script name : LimeSurvey PHPSurveyor Version : 1.49RC2 Type : RFIRemote File Include Source :...
DEBIAN-CVE-2010-5294
Multiple cross-site scripting XSS vulnerabilities in the requestfilesystemcredentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a 1 FTP or 2 SSH connection attempt...
CVE-2010-5294: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the requestfilesystemcredentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a 1 FTP or 2 SSH connection attempt...
CVE-2013-7240: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter...
FlashComs Chat Script File Upload
"@".$options'f'."","fileId" = $options"f"; $result = curlexec$handle; ifstrpos$result,"UPLOADSUCCESS" echo "\n\n"; echo "\t+ Exploitation success!!\n"; echo "\t+ http://$optionsu/files/$optionsf\n"; echo "...
CVE-2013-2245: Improper Authentication
rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed...
CVE-2011-5134: Undefined Security Weakness
Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: so...
CVE-2010-5091
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
Code injection
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
CVE-2010-5091
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
CVE-2010-5091
The CVE-2010-5091 vulnerability affects SilverStripe 2.3.x (before 2.3.8) and 2.4.x (before 2.4.1), where the setName function in filesystem/File.php allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing an uploaded file’s extension. Root cause: in...
CVE-2010-5091: Improper Control of Generation of Code
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...
Powie pFile 1.01 SQL injection vulnerability
Exploit for php platform in category web applications +----------------------------------------------------------------------+ Exploit Title: Powie pFile 1.01 SQL injection vulnerability Google Dork: inurl:pfile/file.php?id= intext:"-- pFile 1.01 OS" Date: 22/06/2012 Exploit Author: Tunisian...
CVE-2012-2902: Undefined Security Weakness
Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor JCE component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as...