280 matches found
wordpress_DoS
WordPress 4.9.8 es vulnerable a ataques DoS. Información adicional Encontramos una denegación de servicio DoS en WordPress versión 4.9.8. Un usuario remoto no autenticado puede realizar una serie de solicitudes en las páginas vulnerables, lo que provoca un aumento del procesamiento, del swap y de...
opendcim-exploit
openDCIM - SQLi to RCE via Config Poisoning Remote code execution chain targeting openDCIM's install.php LDAP configuration form. Built on the VulnCheck go-exploit framework. Vulnerability Chain...
CVE-2025-61505
CVE-2025-61505 – Inyección de objetos PHP en e107 CMS 2.x Reportado: 18 de septiembre de 2025 CVE asignado: 9 de octubre de 2025 Publicado: 02 de febrero de 2026 ID CVE: CVE-2025-61505 Descubridor: Anas Abderrahman Benbarek Resumen Se descubrió una vulnerabilidad de Inyección de Objetos PHP...
WBCE-v1.6.3-Authenticated-RCE
WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; Una vez que el módulo pasa esta verificación como "Add-On válido", cualquier script install.php se ejecuta automáticamente en el servidor. Este exploit simplemente utiliza un reverse shell en PHP como payload PHP...
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...
CVE-2018-19180
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...
CVE-2019-12204
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
CVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...
CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...
EUVD-2025-33763
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
e107 安全漏洞
e107 is an open source, free and PHP and MySQL based content management system CMS by the E107 team. The system supports a wide range of plug-ins and look-alike themes, and can be used as a personal blog, discussion community, archive repository, and so on. A security vulnerability exists in e107...
CVE-2025-61505
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
CVE-2025-61505
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
EUVD-2007-0701
Malware in sbrugna...
EUVD-2018-10603
Malware in sbrugna...
EUVD-2019-17251
Malware in sbrugna...