Remote file inclusion

PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter...

CVE-2015-4726

PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter...

Code injection

Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language, as demonstrated by language/italian.php...

CVE-2015-4338

CVE-2015-4338 affects the WordPress XCloner plugin (version 3.1.2). The vulnerability is a static code injection that lets remote authenticated users inject arbitrary PHP code into language files via the Translation LM_FRONT_* field (demonstrated by language/italian.php). Impact described: potent...

CVE-2015-4338

Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language, as demonstrated by language/italian.php...

WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - doupload.php Arbitrary File Upload

WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - doupload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/53790/info The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue...

WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - 'doupload.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/53790/info The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can...

Hive 2.0 RC2 XSS / Code Execution / SQL Injection

| Title : Hive v2.0 RC2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : "Powered by DigitalHive" | Tested on: windows 8.1 Français V.Pro | Bug : Stop Script | Download : http:///www.digitalhive.com ======================================= Stop SCript working :...

NetCharts Server Multiple Vulnerabilities

NetCharts Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Unrestricted file upload

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/...

WordPress ReFlex Gallery Plugin <= 3.1.3 - Unrestricted File Upload

This vulnerability is in admin/scripts/FileUploader/php.php. It allows an attacker to execute arbitrary PHP code by uploading a file with a PHP extension. And then an attacker can access it via a direct request to the file in uploads/ directory. Solution Update the plugin...

mt-phpincgi Arbitrary PHP Code Execution Vulnerability

mt-phpincgi is a script that runs Movable Type templates. An arbitrary PHP code execution vulnerability exists in mt-phpincgi, which allows remote attackers to submit a special request to execute arbitrary PHP code in the context of a web process...

CVE-2015-0935

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

CVE-2015-0935

Bomgar Remote Support prior to 15.1.1 is vulnerable to arbitrary PHP code execution via crafted serialized data that is deserialized by the application. The root cause is improper handling of untrusted serialized input (PHP unserialize) in the Bomgar portal, enabling an attacker to execute code i...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator user via an add action to admin/index.php or 2 conduct static PHP code injection attacks via...

CVE-2012-4902

CVE-2012-4902 concerns Template CMS 2.1.1 and earlier. The vulnerability is a CSRF flaw that lets an attacker trick an authenticated administrator into performing unauthorized actions, including adding a new administrator account and potentially triggering code execution through the admin interfa...

CVE-2012-4902

Multiple cross-site request forgery CSRF vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator user via an add action to admin/index.php or 2 conduct static PHP code injection attacks via...

WebUI 1.5b6 PHP Code Injection

| Title : WebUI 1.5b6 PHP code injection Vulnerability | Author : indoushka | email : [email protected] | Dork : c2002-2010 Young Consulting | Tested on: Win 8.1 fr pro / 22:30 15/05/2015 | Bug : PHP code injection | Download : https://github.com/baram01/webui/...

WordPress Wp Image Zoom Plugin <= 1.0.3 - PHP Code Execution

This plugin is prone to download.php file upload PHP code execution vulnerability. Solution Update plugin...

Wordpress RevSlider File Upload and Execute Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress ThemePunch Revolution Slider revslider plugin, version 3.0.95 and prior. The vulnerability allows for arbitrary file upload and remote code execution. Usage Info msf use exploit/unix/webapp/wprevslideruploadexecute msf...