CVE-2019-16314

Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2...

Remote code execution

Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2...

CVE-2019-16314

Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2...

CVE-2019-16314

Indexhibit 2.1.5 is vulnerable to remote code execution via the installer, exposed through /ndxzstudio/install.php?p=2. The vulnerability is documented in multiple sources (NVD, CNVD, Red Hat) with the same description, indicating that a product reinstallation can be abused to execute code remote...

Code execution vulnerability in indexhibits CMS

Indexhibit is a pioneering CMS web application created in 2006 for creating websites in an established index + exhibit format. A code execution vulnerability exists in indexhibits CMS, which can be exploited by an attacker to reinstall the web system and enter a backend getshell to gain server...

CVE-2019-8954

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

Design/Logic Flaw

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

CVE-2019-8954

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

CVE-2019-8954

Indexhibit 2.1.5 is affected by CVE-2019-8954. The vulnerability allows remote attackers to execute arbitrary code via the v parameter (used with the id parameter) in an upd_jxcode=true action to the ndxzstudio/?a=system URI. Several connected documents corroborate code execution impact on affect...

CVE-2019-8954

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...