PT-2020-20179 · Artica · Artica Pandora Fms

Name of the Vulnerable Software and Affected Versions: Artica Pandora FMS version 7.42 Description: The issue allows Web Admin users to execute arbitrary code by uploading a .php file via the Updater or Extension component. However, the vendor reports that this functionality is intended...

PT-2020-8650

Name of the Vulnerable Software and Affected Versions: Fleetco Fleet Maintenance Management FMM versions 1.2 and earlier Description: The issue allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the "accidents add.php?submit=1" URI, as demonstrated by the value...

Code Execution Vulnerability in Vanno Enterprise Website Management System ch***.php File

Vanno Enterprise Website Management System is a website content management system based on a full DIV+CSS template. A code execution vulnerability exists in the file ch.php in Vanno's enterprise website management system. An attacker can exploit the vulnerability to execute arbitrary code...

SQL Injection Vulnerability in SemCMS SE***_Im***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEIm.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive information in the database...

CVE-2020-9265

phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmcusername...

SQL injection vulnerability in In***.php file of MyuCMS open source content management system (CNVD-2020-18786)

MyuCMS open source content management system developed using ThinkPHP community mall aggregation, plug-ins, templates, lightweight and fast easy to expand. MyuCMS open source content management system In.php file SQL injection vulnerability . Attackers can exploit the vulnerability to obtain...

SQL injection vulnerability in Zendo Project Management Software co***.php file

Zendo Project Management Software is homegrown open source project management software. Zendo Project Management Software co.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

PT-2020-20292 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.12 Description: The issue allows Directory Traversal, enabling the inclusion of arbitrary .php files within the webroot via the add to prospect list function. Recommendations: For SuiteCRM versions prior to...

PT-2020-7338

Name of the Vulnerable Software and Affected Versions: PolarBear CMS version 2.5 Description: A PHP file upload issue exists, which could allow a malicious user to execute arbitrary code via the upload.php endpoint. Recommendations: For PolarBear CMS version 2.5, consider restricting access to th...

Exploit for Unrestricted Upload of File with Dangerous Type in Artica Pandora_Fms

CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 A...

CVE-2012-5699

BabyGekko before 1.2.4 allows PHP file inclusion...

Arbitrary file deletion

BabyGekko before 1.2.4 allows PHP file inclusion...

CVE-2012-5699

BabyGekko before 1.2.4 allows PHP file inclusion...

CVE-2012-5699: Improper Input Validation

BabyGekko before 1.2.4 allows PHP file inclusion...

PT-2020-7266

Name of the Vulnerable Software and Affected Versions: BabyGekko versions prior to 1.2.4 Description: The issue allows PHP file inclusion. Recommendations: For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue...

Unspecified Vulnerability in Logaritmo Aware CallManager

Logaritmo Aware CallManager is an enterprise telephone call management system. A security vulnerability exists in the CSV upload feature of the /supervisor/procesacarga.php file in the 2012 version of Logaritmo Aware CallManager, which can be exploited by an attacker accessing the /supervisor/csv...

CVE-2020-5505

Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring in conjunction with "type":"application/x-php" to the /api/files/ URI...

Denial Of Service (DoS)

dompdf is vulnerable to denial of service DoS. The attack exists because dompdf.php does not handle the parsing of PHP file properly, allowing an attacker to consume memory by providing files such as dompdfconfig.inc.php...

SQL Injection Vulnerability in me***.php file of Yunye CMS frontend

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. There is a SQL injection vulnerability in the me.php file in the frontend of Yunye CMS. Attackers can use the vulnerability to obtain sensitive information in the database...

Complaint Management System 4.0 Remote Code Execution

Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows Description: There...