80 matches found
Linux Distros Unpatched Vulnerability : CVE-2014-1879
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a...
CVE-2013-10043: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the...
CVE-2025-4009: Improper Neutralization of Special Elements used in a Command
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...
CVE-2025-1320 teachPress <= 9.0.9 - Cross-Site Request Forgery to Import Delete
The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request...
PT-2025-12767 · WordPress · Teachpress
Name of the Vulnerable Software and Affected Versions: teachPress plugin for WordPress versions up to, and including, 9.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the "import.php" page. This allows unauthenticated attackers ...
CVE-2025-1320: Cross-Site Request Forgery (CSRF)
The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request...
CVE-2024-25641: Improper Input Validation
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web...
phpMyAdmin Global variables scope injection vulnerability
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...
GHSA-X962-W72P-MV7Q phpMyAdmin Global variables scope injection vulnerability
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request...
PT-2021-20907
Name of the Vulnerable Software and Affected Versions: Chamilo LMS version v1.11.x Description: A remote code execution RCE vulnerability in the course intro pdf import.php file allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. Recommendations: For version...
PT-2021-3536
Name of the Vulnerable Software and Affected Versions Chamilo versions 1.11.x Description The issue is related to the admin/user import.php file in Chamilo, which reads XML data without properly disabling the ability to load external entities. This can lead to an XXE XML External Entity attack,...
PT-2021-18035
Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "/users/admin/users import.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...
PT-2020-16167
Name of the Vulnerable Software and Affected Versions Cacti version 1.2.13 Description A cross-site scripting XSS issue exists due to improper escaping of error messages during template import preview in the xml path field. This occurs in the templates import.php file. Recommendations For Cacti...
WordPress ultimate-faqs plugin HTML content injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. ultimate-faqs is a FAQ plugin used in it. An HTML content injection vulnerability exists in the Functions/EWDUFAQImport.php file in...
PT-2019-15021
Name of the Vulnerable Software and Affected Versions ultimate-faqs plugin versions prior to 1.8.25 Description The issue allows HTML content injection in the ultimate-faqs plugin for WordPress. This is due to a problem in the Functions/EWD UFAQ Import.php file. Recommendations For versions prior...
PT-2019-15020
Name of the Vulnerable Software and Affected Versions ultimate-faqs plugin versions prior to 1.8.25 Description The issue allows unauthenticated options import. This is related to the Functions/EWD UFAQ Import.php file in the ultimate-faqs plugin for WordPress. Recommendations For versions prior ...
PlaySMS import.php Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS import.php Authenticated CSV File Upload Code Execution', 'Description' = %q This module exploits an authenticated file upload remote cod...
PlaySMs 1.4 'import.php' Remote Code Execution
Description Code Execution using import.php We know import.php accept file and just read content not stored in server. But when we stored payload in our backdoor.csv and upload to phonebook. Its execute our payload and show on next page in field in NAME,MOBILE,Email,Group COde,Tags accordingly . ...
