PT-2020-20179 · Artica · Artica Pandora Fms

Name of the Vulnerable Software and Affected Versions: Artica Pandora FMS version 7.42 Description: The issue allows Web Admin users to execute arbitrary code by uploading a .php file via the Updater or Extension component. However, the vendor reports that this functionality is intended...

SQL Injection Vulnerability in SemCMS SE***_Im***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEIm.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive information in the database...

Code Execution Vulnerability in Vanno Enterprise Website Management System ch***.php File

Vanno Enterprise Website Management System is a website content management system based on a full DIV+CSS template. A code execution vulnerability exists in the file ch.php in Vanno's enterprise website management system. An attacker can exploit the vulnerability to execute arbitrary code...

SQL injection vulnerability in Zendo Project Management Software co***.php file

Zendo Project Management Software is homegrown open source project management software. Zendo Project Management Software co.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL injection vulnerability in In***.php file of MyuCMS open source content management system (CNVD-2020-18786)

MyuCMS open source content management system developed using ThinkPHP community mall aggregation, plug-ins, templates, lightweight and fast easy to expand. MyuCMS open source content management system In.php file SQL injection vulnerability . Attackers can exploit the vulnerability to obtain...

PT-2020-20292 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.12 Description: The issue allows Directory Traversal, enabling the inclusion of arbitrary .php files within the webroot via the add to prospect list function. Recommendations: For SuiteCRM versions prior to...

Exploit for Unrestricted Upload of File with Dangerous Type in Artica Pandora_Fms

CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 A...

CVE-2012-5699

BabyGekko before 1.2.4 allows PHP file inclusion...

Arbitrary file deletion

BabyGekko before 1.2.4 allows PHP file inclusion...

CVE-2012-5699

BabyGekko before 1.2.4 allows PHP file inclusion...

Unspecified Vulnerability in Logaritmo Aware CallManager

Logaritmo Aware CallManager is an enterprise telephone call management system. A security vulnerability exists in the CSV upload feature of the /supervisor/procesacarga.php file in the 2012 version of Logaritmo Aware CallManager, which can be exploited by an attacker accessing the /supervisor/csv...

Denial Of Service (DoS)

dompdf is vulnerable to denial of service DoS. The attack exists because dompdf.php does not handle the parsing of PHP file properly, allowing an attacker to consume memory by providing files such as dompdfconfig.inc.php...

SQL Injection Vulnerability in me***.php file of Yunye CMS frontend

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. There is a SQL injection vulnerability in the me.php file in the frontend of Yunye CMS. Attackers can use the vulnerability to obtain sensitive information in the database...

Complaint Management System 4.0 - Remote Code Execution

Complaint Management System 4.0 - Remote Code Execution Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category:...

Complaint Management System 4.0 Remote Code Execution

Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows Description: There...

Remote code execution

An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory component on port 389, may upload a PHP file to achieve Remote Code Execution as SYSTEM...

The vulnerability of the openregion.security module of the “Open Region” platform, which arises due to insufficient validation of input data, allows attackers to execute arbitrary code or carry out cross-site scripting attacks.

The vulnerability of the “Open Region” platform exists due to insufficient verification of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or perform a cross-site scripting attack by uploading files with extensions .pht, .php7, .php5, .php3, .php4,...

The vulnerability of the openregion.security module of the “Open Region” platform allows a perpetrator to execute arbitrary commands.

The vulnerability of the openregion.security module of the “Open Region” platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by uploading a php file to the server via a POST request...

CVE-2019-19594

reset/modules/fotoliaFoto/multiupload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file...

CVE-2019-19595

reset/modules/advancedformmakeredit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file...