372 matches found
CVE-2018-18892
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the sitename field in mcconf.php...
CVE-2018-18892
The CVE-2018-18892 entry concerns MiniCMS 1.10, where the install.php sitename parameter can be manipulated to execute arbitrary PHP code, affecting the site_name field in mc_conf.php. The vulnerability is a code execution flaw rooted in input handling and file configuration, with CVSS metrics in...
CVE-2018-18892: Improper Control of Generation of Code
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the sitename field in mcconf.php...
CVE-2018-17126
CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...
CVE-2018-17126: Improper Control of Generation of Code
CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...
CVE-2018-16730
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...
Cross site scripting
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...
CVE-2018-16730
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...
CVE-2018-16730
CVE-2018-16730 : In CScms 4.1, a cross-site scripting (XSS) vulnerability exists in the file path "\upload\plugins\sys\Install.php" triggered via the site name. The issue is documented across multiple sources (e.g., NVD/CNVD entries) as a CMS-originated XSS in that specific component. The connect...
CVE-2018-16730: Improper Neutralization of Input During Web Page Generation
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...
Code injection
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php...
CVE-2018-10429
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php...
CVE-2018-10429
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php...
CVE-2018-10429: Improper Control of Generation of Code
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php...
CVE-2018-7448: Improper Neutralization of Special Elements used in an OS Command
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure...
CVE-2018-7271: Improper Control of Generation of Code
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...
CVE-2018-5749
install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the 1 databaseserver, 2...
SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...