4061 matches found
PT-2018-18878
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The issue concerns a CSRF vulnerability in the file manage control.php file. This vulnerability can be exploited by renaming an arbitrary file under uploads/userup to a .php file under the web root, allowing for...
CVE-2018-8823
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
PT-2018-18645
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module version 1.0.32 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the code parameter in the...
CVE-2014-2293
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the 1 authenticationmethodser or 2 authenticationinfoser parameter to index.php, or 3...
PT-2018-4194
Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11 Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code...
PT-2018-1144
Name of the Vulnerable Software and Affected Versions Mitel Connect ONSITE versions R1711-PREM and earlier Mitel ST 14.2 release GA28 and earlier Description A vulnerability in the conferencing component could allow an unauthenticated attacker to inject PHP code using specially crafted requests t...
PT-2018-4173
Name of the Vulnerable Software and Affected Versions Eventum versions prior to 2.3.5 Description The issue allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter in the htdocs/setup/index.php file. Recommendations For versions prior to 2.3.5, update to versio...
CVE-2018-6383
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php and similar file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-180...
PHP Code Execution Vulnerability in JCCMS of Chengdu Torch Cheng Information Technology Co.
JCCMS is a website building system developed by Chengdu Torch Cheng Information Technology Co. JCCMS has a code execution vulnerability that can be exploited by attackers to execute arbitrary PHP code...
Samsung SRN-1670D Web Viewer 1.0.0.193 Arbitrary File Read / Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'digest' class MetasploitModule 'Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload', 'Description' = %q This module exploits an...
b2evolution CMS 6.8.10 PHP Code Execution
b2evolution CMS 6.6.0 - 6.8.10 PHP code execution Information =========== Name: b2evolution CMS 6.8.10 Software: b2evolution CMS Homepage: http://b2evolution.net/ Vulnerability: PHP code execution Prerequisites: publicly accessible /install functionality CVE: CVE-2017-1000423 Credit: Anti RA$?is...
b2evolution CMS 6.8.10 PHP Code Execution Vulnerability
Exploit for php platform in category web applications b2evolution CMS 6.6.0 - 6.8.10 PHP code execution Information =========== Name: b2evolution CMS 6.8.10 Software: b2evolution CMS Homepage: http://b2evolution.net/ Vulnerability: PHP code execution Prerequisites: publicly accessible /install...
Input validation
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...
CVE-2017-1000423
CVE-2017-1000423 affects b2evolution CMS versions 6.6.0–6.8.10. The root cause is input validation in the basic install functionality (backslash and single quote escape), allowing an unauthenticated attacker to gain PHP code execution on the victim’s setup. Multiple sources corroborate a remote P...