26 matches found
CVE-2018-16763
CVE-2018-16763 Analyzer CVE-2018-16763 Analyzer is a small Python project for analyzing CVE-2018-16763 against FUEL CMS targets. It focuses on checking whether a target appears vulnerable and on displaying command output in a cleaner, more readable way when the application response is noisy. This...
CVE_2018_16763_Proof_of_Concept
CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...
CVE-2018-16763_FuelCMS-1.4.1_RCE
CVE-2018-16763 FuelCMS - 1.4.1 - RCE PoC FuelCMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Exploit This works by exploiting the PHP filter parameter which allows you to use the system...
exploit_cms_fuel
Fuel CMS 1.4.1 - Remote Code Execution RCE Exploit This repository contains a Python 3 implementation of an exploit for Fuel CMS version 1.4.1. The script leverages CVE-2018-16763 , a vulnerability where insufficient input validation in the filter and preview parameters allows for PHP Code...
CVE-2018-16763
Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install git clone https://github.com/Trushal2004/CVE-2018-16763.git cd CVE-2018-16763/ python3 -...
THM-Vulnerability_Capstone-CVE-2018-16763
THM-VulnerabilityCapstone-CVE-2018-16763 A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763. CREDITS I do not take credit for the discovery of this vulnerability. Thank you to the following people. Vulnerability Discovery: 0xd0ff9 TryHackMe Room & Author:...
FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)
Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...
CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...
CVE-2026-54718
Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...
FUEL CMS 1.4.1 - Remote Code Execution Detection
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...
EUVD-2020-4145
Malware in sbrugna...
CVE-2020-11803
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...
CVE-2020-11803
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...
Input validation
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...
CVE-2020-11803
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...
CVE-2020-11803
CVE-2020-11803 affects SpamTitan 7.07. The issue arises from improper sanitization of the jaction parameter on mailqueue.php, where user input is passed directly to PHP eval(), enabling server-side code evaluation after authentication. Exploitation details are documented in multiple connected sou...
PT-2020-12856
Name of the Vulnerable Software and Affected Versions SpamTitan version 7.07 Description An issue was discovered where improper sanitization of the jaction parameter when interacting with the "mailqueue.php" page could lead to server-side PHP code evaluation. This occurs because user-provided inp...
CVE-2020-11803: Improper Control of Generation of Code
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...
