3051 matches found
zzzcms v1.5.8 SQL Injection Vulnerability in Frontend in***.php File
zzcms is a free website builder developed in asp language. zzzcms v1.5.8 SQL injection vulnerability exists in the foreground in.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...
i-doit CMDB 1.11.2 Remote Code Execution
Exploit Title: i-doit CMDB 1.11.2 - Remote Code Execution Date: 2018-12-05 Exploit Author: Azkan Mustafa AkkuA AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.i-doit.org/ Software Link: https://www.i-doit.org/i-doit-open-1-11-2/ Version: v1.11.2 Category: Webapps Tested on: XAM...
CVE-2018-19692
An issue was discovered in tp5cms through 2017-05-25. admin.php/upload/picture.html allows remote attackers to execute arbitrary PHP code by uploading a .php file with the image/jpeg content type...
SQL Injection Vulnerability in VANOC Enterprise Website Management System (PHP Version) cm***.php File
Vanno enterprise website management system PHP version is a php+MySQL development of php enterprise website management system. A SQL injection vulnerability exists in the cm.php file of the VANOC enterprise website management system PHP version. An attacker can exploit the vulnerability to obtain...
CVE-2018-19355: Unrestricted Upload of File with Dangerous Type
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop 1.5 through 1.7 allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product for upload destinations under...
Command Execution Vulnerability in In***.php File of CloudYou CMS Enterprise Website Management System
YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. A command execution vulnerability exists in the In.php file of the YUNUCMS enterprise website management system. An attacker can exploit...
Code injection
An issue was discovered in laravelCMS through 2018-04-02. \app\Http\Controllers\Backend\ProfileController.php allows upload of arbitrary PHP files because the file extension is not properly checked and uploaded files are not properly renamed...
PT-2018-14709
Name of the Vulnerable Software and Affected Versions laravelCMS versions prior to 2018-04-02 Description An issue was discovered that allows the upload of arbitrary PHP files. This is because the file extension is not properly checked and uploaded files are not properly renamed in the...
CVE-2018-18874
nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...
CVE-2018-18382
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...
SQL Injection Vulnerability in Five Fingers CMS v4.1.0
Five fingers CMS is a high-performance open source content management system , support for LNAMP architecture . Five Fingers CMS v4.1.0 SQL injection vulnerability exists , the vulnerability stems from the failure to filter ca.php file in the groupname parameter , an attacker can use the...
D-Link Central WiFiManager Software Controller Code Execution / XSS Exploit
D-Link Central WiFiManager Software Controller suffers from hard-coded credential, code execution, and cross site scripting vulnerabilities. Version 1.03 is affected. D-Link Central WiFiManager Software Controller Multiple Vulnerabilities 1. Advisory Information Title: D-Link Central WiFiManager...
D-Link Central WiFiManager Software Controller Multiple Vulnerabilities
1. Advisory Information Title: D-Link Central WiFiManager Software Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0010 Advisory URL:http://www.coresecurity.com/core-labs/advisories/d-link-central-wifimanager-software-controller-multiple-vulnerabilities Date published: 2018-10-04 Date...
Winmail Server < 6.3 Directory Traversal Vulnerability
Winmail Server allows remote code execution RCE by authenticated users who leverage directory traversal in a netdisk.php copyfolderfile call in inc/class.ftpfolder.php to move a .php file from the FTP folder into a web folder. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might...
SQL injection vulnerability in ZZCMS version 8.3 zs***.php file (CNVD-2018-19951)
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the zs.php file of ZZCMS version 8.3. An attacker can exploit the vulnerability to obtain sensitive information from the database...
SQL injection vulnerability in cl***.php file in ZZCMS 8.3 version
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the cl.php file in ZZCMS version 8.3. An attacker can exploit the vulnerability to obtain sensitive database information...
CVE-2018-17139
UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...
CVE-2018-16549
HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter...
