CVE-2018-16763

Fuel CMS 1.4.1 - Ejecución Remota de Código FUEL CMS 1.4.1 permite la evaluación de código PHP a través del parámetro filter de pages/select/ o del parámetro data de preview/. Esto puede provocar una Ejecución Remota de Código sin autenticación previa. Instalación root@kitploit: git clone...

CVE-2018-16763

Analizador CVE-2018-16763 CVE-2018-16763 Analyzer es un pequeño proyecto de Python para analizar CVE-2018-16763 contra objetivos FUEL CMS. Se centra en verificar si un objetivo parece vulnerable y en mostrar la salida de comandos de forma más limpia y legible cuando la respuesta de la aplicación ...

THM-Vulnerability_Capstone-CVE-2018-16763

THM-VulnerabilityCapstone-CVE-2018-16763 A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763. CREDITS I do not take credit for the discovery of this vulnerability. Thank you to the following people. Vulnerability Discovery: 0xd0ff9 TryHackMe Room & Author:...

CVE-2018-16763_FuelCMS-1.4.1_RCE

CVE-2018-16763 FuelCMS - 1.4.1 - RCE PoC FuelCMS 1.4.1 permite la evaluación de código PHP a través del parámetro filter de pages/select/ o del parámetro data de preview/. Esto puede conducir a una ejecución remota de código sin autenticación previa. Exploit Esto funciona explotando el parámetro...

exploit_cms_fuel

Fuel CMS 1.4.1 - Exploit de Ejecución Remota de Código RCE Este repositorio contiene una implementación en Python 3 de un exploit para Fuel CMS versión 1.4.1. El script aprovecha CVE-2018-16763 , una vulnerabilidad donde la validación insuficiente de entrada en los parámetros filter y preview...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Prueba de concepto Un exploit de prueba de concepto PoC para CVE-2018-16763 Fuel CMS - Ejecución remota de código sin autenticación previa. Descripción Este programa en Python 3 sirve como PoC para la vulnerabilidad CVE-2018-16763 en el sistema de gestión de contenidos Fuel CMS...

CVE-2026-54718

Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...

CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

EUVD-2020-4145

Malware in sbrugna...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

Input validation

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

CVE-2020-11803 affects SpamTitan 7.07. The issue arises from improper sanitization of the jaction parameter on mailqueue.php, where user input is passed directly to PHP eval(), enabling server-side code evaluation after authentication. Exploitation details are documented in multiple connected sou...

Remote code execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

Summary (CVE-2018-16763) : Fuel CMS version 1.4.1 is vulnerable to a pre-auth Remote Code Execution via PHP code evaluation. The flaw is triggered through unsafe handling of user-controlled data in the pages/select/ filter parameter or the preview/ data parameter, allowing arbitrary PHP execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Recent assessments: noraj at May 08, 2021 7:33pm UTC reported: Unauthenticated RCE with default config, this is critical. Assessed...