CVE-2018-16763

Fuel CMS 1.4.1 - Ejecución Remota de Código FUEL CMS 1.4.1 permite la evaluación de código PHP a través del parámetro filter de pages/select/ o del parámetro data de preview/. Esto puede provocar una Ejecución Remota de Código sin autenticación previa. Instalación git clone...

CVE-2018-16763_FuelCMS-1.4.1_RCE

CVE-2018-16763 FuelCMS - 1.4.1 - RCE PoC FuelCMS 1.4.1 permite la evaluación de código PHP a través del parámetro filter de pages/select/ o del parámetro data de preview/. Esto puede conducir a una ejecución remota de código sin autenticación previa. Exploit Esto funciona explotando el parámetro...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Prueba de concepto Un exploit de prueba de concepto PoC para CVE-2018-16763 Fuel CMS - Ejecución remota de código sin autenticación previa. Descripción Este programa en Python 3 sirve como PoC para la vulnerabilidad CVE-2018-16763 en el sistema de gestión de contenidos Fuel CMS...

CVE-2018-16763

Analizador CVE-2018-16763 CVE-2018-16763 Analyzer es un pequeño proyecto de Python para analizar CVE-2018-16763 contra objetivos FUEL CMS. Se centra en verificar si un objetivo parece vulnerable y en mostrar la salida de comandos de forma más limpia y legible cuando la respuesta de la aplicación ...

THM-Vulnerability_Capstone-CVE-2018-16763

THM-VulnerabilityCapstone-CVE-2018-16763 Un write-up sobre la sala THM Vulnerability Capstone y el script de exploit para CVE-2018-16763. CRÉDITOS No me atribuyo el mérito del descubrimiento de esta vulnerabilidad. Gracias a las siguientes personas. Descubrimiento de la vulnerabilidad: 0xd0ff9 Sa...

exploit_cms_fuel

Fuel CMS 1.4.1 - Exploit de Ejecución Remota de Código RCE Este repositorio contiene una implementación en Python 3 de un exploit para Fuel CMS versión 1.4.1. El script aprovecha CVE-2018-16763 , una vulnerabilidad donde la validación insuficiente de entrada en los parámetros filter y preview...

CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

CVE-2026-54718

Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...

EUVD-2020-4145

Malware in sbrugna...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

Input validation

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

CVE-2020-11803

CVE-2020-11803 affects SpamTitan 7.07. The issue arises from improper sanitization of the jaction parameter on mailqueue.php, where user input is passed directly to PHP eval(), enabling server-side code evaluation after authentication. Exploitation details are documented in multiple connected sou...

CVE-2020-11803: Improper Control of Generation of Code

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval function. The user has to be authenticated...

Remote code execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

Summary (CVE-2018-16763) : Fuel CMS version 1.4.1 is vulnerable to a pre-auth Remote Code Execution via PHP code evaluation. The flaw is triggered through unsafe handling of user-controlled data in the pages/select/ filter parameter or the preview/ data parameter, allowing arbitrary PHP execution...