Arbitrary file deletion

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code...

File Containment Vulnerability in Huake Network Enterprise Management System

Huake Enterprise Management System is an intelligent website builder based on PHP+MySQL, with only one set of templates, 3 channel models + 1 detail model, and no duration of use or functionality limitations. Huake Network Enterprise Management System has a file inclusion vulnerability, which can...

File Inclusion Vulnerability in TpShop

Tpshop is an open source mall system of Shenzhen SoBao Network Co. TpShop has a file inclusion vulnerability that can be exploited by attackers to execute malicious code...

File Inclusion Vulnerability in DPtech SSL VPNs

Ltd. is a high-tech listed enterprise integrating R&D, production and sales in the field of network security and application delivery. A file inclusion vulnerability exists in DPtech SSL VPN, which can be exploited by attackers to obtain sensitive information...

File Inclusion Vulnerability in mlecms v2.3

mlecms is a PHP + MYSQL based on the core development of the station-building system. A file inclusion vulnerability exists in mlecms v2.3. The vulnerability is due to unfiltered incoming parameters are directly spliced into file paths. An attacker can use this vulnerability to obtain php files...

File Containment Vulnerability in Tongda OA 2017

Ltd. is subordinate to China National Weapons Industry Information Center CNWIIC, which is referred to as Tongda Xinke. It is a high-tech team with the main business of collaborative management software development and implementation, service and consulting. A file inclusion vulnerability exists ...

CVE-2014-9186

A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell...

WordPress Core 5.0.0 - Crop-image Shell Upload (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Crop-image Shell Upload', 'Description' = %q This module exploits a path traversal and a local file inclusion vulnerability on WordPres...

SQL Injection Vulnerability in DM Website System

DM building system is developed by php + mysql a set of specialized for small and medium-sized enterprise website construction of open source cms. DM building system has a file inclusion vulnerability , attackers can use the vulnerability to obtain database information...

CVE-2019-9644

An XSSI cross-site inclusion vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of erro...

File Inclusion Vulnerability in DM Website System

DM building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM website builder system has a file inclusion vulnerability , attackers can use the vulnerability to obtain sensitive information...

File Inclusion Vulnerability in Vanno Enterprise Management System PHP ch***.php File

Vanno Enterprise Management System PHP version 2.0 background channel.php file contains vulnerabilities A file inclusion vulnerability exists in the PHP ch.php file of the Vanno Enterprise Management System. An attacker can exploit the vulnerability to upload a shell and gain server privileges...

File Inclusion Vulnerability in aitecms V1.0

Hainan Zanzan Network Technology Co., Ltd. is a network company in the industry that provides professional website construction, network service and operation technology output. aitecms V1.0 has a file inclusion vulnerability that can be exploited by attackers to access arbitrary files...

CVE-2018-1000504

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

WordPress Redirection Plugin PHP File Execution Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress Redirection Plugin PHP File Execution Vulnerability ACE File Inclusion Vulnerability allows administrators to execu...

A Good Shell Is Hard to Choose

I had the recent opportunity to speak at BSides SLC, held on the Sandy campus of Salt Lake Community College. I tailored my presentation to the student demographic and chose to talk about one of the fundamental concepts that a penetration tester must understand: types of shells. I touched on the...

File inclusion vulnerability in the get_url_contents() method of the DSmall Multi-User Mall system

DSmall is a multi-user mall system source code developed with thinkPHP as the framework. DSmall multi-user mall system geturlcontents method file inclusion vulnerability. Allow attackers to exploit the vulnerability to remotely execute arbitrary code...

File Containment Vulnerability in Youkai 365 Business v1.5 System

Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. A file inclusion vulnerability exists in the UX365 Business v1.5 system, which is due...

CVE-2015-5070

Removed by vendor...

CVE-2017-14404

Affected software: EyesOfNetwork web interface (eonweb) 5.1-0. Vulnerability type: Local File Inclusion via the tool_list parameter (aka url_tool) to module/tool_all/select_tool.php. Root cause / vector: Untrusted tool_list input can be used to include local files (demonstrated by tool_list=php:/...