CVE-2018-20772

CVE-2018-20772 affects Frog CMS 0.9.5. The vulnerability allows PHP code execution via the PHP opening tag in the request to the URI admin/?/layout/edit/1, indicating a code-injection path in that administration handler. The root cause is improper handling of PHP code within that endpoint, enabli...

CVE-2018-20773

CVE-2018-20773 affects Frog CMS 0.9.5, where an attacker can achieve PHP code execution by visiting admin/?/page/edit/1 and injecting additional

CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...

PT-2019-10215

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows PHP code execution. This can be achieved by sending ?php code to the "admin/?/layout/edit/1" URI, which is an API endpoint. Recommendations: For Frog CMS version 0.9.5, update to a newer...

PT-2019-18720

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description An issue was discovered that allows an attacker to execute arbitrary PHP code via a race condition in the backend database backup function. This can be achieved by leveraging the admin/index.php and...

CVE-2018-20773: Improper Control of Generation of Code

Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional...

CVE-2018-20772: Improper Control of Generation of Code

Frog CMS 0.9.5 allows PHP code execution via...

CVE-2018-20775: Improper Control of Generation of Code

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI...

PT-2019-10216

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows PHP code execution. This can be achieved by visiting the "admin/?/page/edit/1" endpoint and inserting additional ?php lines. Recommendations: For Frog CMS version 0.9.5, consider restrictin...

PT-2019-10218

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows PHP code execution by creating a new .php file containing PHP code through the "admin/?/plugin/file manager" endpoint, and then visiting this file under the public/ URI. Recommendations: Fo...

Design/Logic Flaw

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file...

CVE-2018-20768

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file...

CVE-2018-20768

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file...

CVE-2018-20768

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file...

PT-2019-10210

Name of the Vulnerable Software and Affected Versions: Xerox WorkCentre versions prior to R18-05 073.xxx.0487.15000 Description: An issue allows an attacker to execute PHP code by leveraging a writable file. Recommendations: For versions prior to R18-05 073.xxx.0487.15000, update to a version tha...

CVE-2018-20768: Improper Control of Generation of Code

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file...

CVE-2019-7580

ThinkCMF 5.0.190111 is vulnerable to remote code execution (RCE) due to a lack of proper input validation. An attacker can execute arbitrary PHP code and OS commands by exploiting the mishandling of a single quote character within the portal/admin_category/addpost.html alias parameter . This flaw...

PT-2019-18655

Name of the Vulnerable Software and Affected Versions ThinkCMF version 5.0.190111 Description The issue allows remote attackers to execute arbitrary PHP code. This is due to the mishandling of a single quote character, which enables data/conf/route.php injection via the "alias" parameter in the...

CVE-2019-7580: Improper Control of Generation of Code

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-7160

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...