4072 matches found
CVE-2019-20183
CVE-2019-20183 affects the Simple Employee Records System 1.0. The vulnerability is an arbitrary file upload flaw in uploadimage.php caused by client-side validation of file extensions, allowing an attacker to upload executable PHP code by bypassing validation (e.g., via modifying global.js). Thi...
CVE-2019-20183
uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension...
PT-2020-10364
Name of the Vulnerable Software and Affected Versions Employee Records System version 1.0 Description The issue allows an attacker to upload and execute arbitrary PHP code due to inadequate file-extension validation, which is only performed on the client side. This can be achieved by modifying th...
PT-2020-7212
Name of the Vulnerable Software and Affected Versions Gateway Geomatics MapServer for Windows versions prior to 3.0.6 Description The issue allows remote attackers to execute local PHP code and obtain sensitive information due to a Local File Include Vulnerability. Recommendations For versions...
CVE-2013-2011
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...
PT-2019-6867
Name of the Vulnerable Software and Affected Versions WP Super Cache Plugin version 1.2 Description The issue concerns remote PHP code execution in the WP Super Cache Plugin. Recommendations For WP Super Cache Plugin version 1.2, update to a newer version that contains a fix for this issue...
CVE-2019-19502: Improper Control of Generation of Code
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter...
CVE-2019-11325: Improper Encoding or Escaping of Output
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter...
PT-2019-12240
Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.2.12 Symfony versions 4.3.x prior to 4.3.8 Description An issue in the VarExport component of Symfony allows specially crafted strings to escalate to the execution of arbitrary PHP code due to incorrect string...
CVE-2011-1028
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smartyinternalcompileprivatespecialvariable.php file...
CVE-2011-1028
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smartyinternalcompileprivatespecialvariable.php file...
File upload vulnerability in the backend of shopxo e-commerce system
ShopXO is an open source enterprise-level open source e-commerce system. shopxo e-commerce system backend file upload vulnerability , an attacker can exploit the vulnerability to execute arbitrary PHP code...
CVE-2011-1028: Improper Input Validation
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smartyinternalcompileprivatespecialvariable.php file...
PT-2019-6613
Name of the Vulnerable Software and Affected Versions Smarty3 affected versions not specified Description The issue allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty internal compile private special variable.php file. This is related to the $smarty.template variabl...
CVE-2012-0694: Improper Input Validation
SugarCRM CE = 6.3.1 contains scripts that use "unserialize" with user controlled input which allows remote attackers to execute arbitrary PHP code...
PT-2019-6725
Name of the Vulnerable Software and Affected Versions SugarCRM CE versions 6.3.1 and earlier Description The issue allows remote attackers to execute arbitrary PHP code due to the use of unserialize with user-controlled input in certain scripts. Recommendations For SugarCRM CE versions 6.3.1 and...
CVE-2015-9499
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive...
