CVE-2020-24186

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action...

CVE-2020-17452

The CVE-2020-17452 entry concerns flatCore CMS (PHP/SQLite) prior to version 1.5.7, where an unrestricted file upload vulnerability allows an admin to upload and execute a PHP file. The root cause is an unrestricted file upload flaw enabling remote code execution; impact details in sources indica...

Newsletter WordPress Plugin Opens Door to Site Takeover

Newsletter, a WordPress plugin with more than 300,000 installations, has a pair of vulnerabilities that could lead to code-execution and even site takeover. The Newsletter plugin offers site admins a visual editor that can be used to create newsletters and email campaigns from within WordPress...

Koken CMS 0.22.24 Shell Upload

Exploit Title: Koken CMS 0.22.24 - Arbitrary File Upload Authenticated Date: 2020-07-15 Exploit Author: v1n1v131r4 Vendor Homepage: http://koken.me/ Software Link: https://www.softaculous.com/apps/cms/Koken Version: 0.22.24 Tested on: Linux PoC:...

Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)

Exploit Title: Koken CMS 0.22.24 - Arbitrary File Upload Authenticated Date: 2020-07-15 Exploit Author: v1n1v131r4 Vendor Homepage: http://koken.me/ Software Link: https://www.softaculous.com/apps/cms/Koken Version: 0.22.24 Tested on: Linux PoC:...

SQL injection vulnerability in p***.php file of website building system of Anyang Zhidao Media Co.

Founded in 2011, Anyang Zhidao Media Co., Ltd. is a formal and professional Anyang network company engaged in Internet business and software development. Anyang Zhidao Media Co., Ltd. building system p.php file SQL injection vulnerability, attackers can use the vulnerability to obtain database...

SQL injection vulnerability in n***.php file of website building system of Anyang Zhidao Media Co.

Founded in 2011, Anyang Zhidao Media Co., Ltd. is a formal and professional Anyang network company engaged in Internet business and software development. Anyang Zhidao Media Co., Ltd. building system n.php file SQL injection vulnerability, attackers can use the vulnerability to obtain database...

SQL injection vulnerability in n***.php file of website building system of Anyang Zhidao Media Co.

Founded in 2011, Anyang Zhidao Media Co., Ltd. is a formal and professional Anyang network company engaged in Internet business and software development. Anyang Zhidao Media Co., Ltd. building system n.php file SQL injection vulnerability, attackers can use the vulnerability to obtain database...

ATutor 2.2.4 CVE-2019-12169 - Remote Code Execution

This Metasploit module exploits an arbitrary file upload vulnerability together with a directory traversal flaw in ATutor This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ATutor 2.2.4 - Director...

Magmi (Magento Mass Importer) <= 0.7.17a Unrestricted File Upload Vulnerability

Magmi is prone to an unrestricted file upload vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Kordil EDMS Command Execution Vulnerability

Kordil EDMS is a document control and management system. A remote code execution vulnerability exists in documentsadd.php in Kordil EDMS 2.2.60rc3 and earlier versions. The vulnerability stems from a .php file that can be uploaded to the Documents folder. A remote attacker could exploit this...

Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)

Exploit Title: Online Student Enrollment System 1.0 - Cross-Site Request Forgery Add Student Google Dork: N/A Date: 2020-06-20 Exploit Author: BKpatron Vendor Homepage: https://www.campcodes.com/projects/php/4745/online-student-enrollment-system-in-php-mysqli/ Software Link:...

TuziCMS v3.0 Ma*** Mo***.cl***.php suffers from SQL injection vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 Ma Mo.cl.php suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

CVE-2020-12800

The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supportedtype to php% and uploading a .php% file...

SQL injection vulnerability in the file li****.php of the website building system of Qingdao Shangzhixin Network Science and Technology Co.

Qingdao Business to letter network technology limited company is a professional engaged in e-commerce, network marketing, software development, IDC and related network value-added services of high-tech specialized companies. There is a SQL injection vulnerability in the file li.php of the website...

Clinic Management System 1.0 - Authenticated Arbitrary File Upload

Exploit Title: Clinic Management System 1.0 - Authenticated Arbitrary File Upload Google Dork: N/A Date: 2020-06-02 Exploit Author: BKpatron Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html Software Link:...

PIMS online order management system ht***.php file has SQL injection vulnerability

PIMS online order management system for single-page ordering sites, general product ordering sites and other ordering sites, designed to facilitate the full background management through the fast integration of Alipay, Paypal, eBao, netbank online, PayPal and other payment interfaces, management ...

CVE-2020-13442

A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/...

Remote code execution

A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/...

Gym Management System 1.0 - Unauthenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Gym Management System 1.0 - Unauthenticated Remote Code Execution Exploit Author: Bobby Cooke Vendor Homepage: https://projectworlds.in/ Software Link:...