PT-2018-12896

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code. This is achieved by writing a file with a PHP extension via the docid and content parameters an...

PT-2018-12892

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory. This is...

SeedDMS Arbitrary File Upload Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. An arbitrary file upload vulnerability exists in the 'op/op.UploadChunks.php' file in...

PT-2018-12589

Name of the Vulnerable Software and Affected Versions GolemCMS through 2008-12-24 Description The issue allows remote attackers to execute arbitrary PHP code by inserting this code into the Table prefix form field in the "Database Information" section, or obtain sensitive information via a direct...

JVN#62423700: Movable Type plugin MTAppjQuery vulnerable to PHP code execution

MTAppjQuery provided by bit part LLC is a plugin for Movable Type. An older version PHP library Uploadify is incorporated in MTAppjQuery v1.8.1 and earlier versions and the older versions of Uploadify contains unrestricted upload of arbitrary file CWE-434, which may lead to arbitrary PHP code...

Cross site scripting

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which m...

OneFileCMS Arbitrary PHP Code Execution Vulnerability

OneFileCMS is a lightweight CMS system. The system runs on PHP and JavaScript and includes features such as document editing, file uploading and file management. A security vulnerability exists in the onefilecms.php file in OneFileCMS version 2012-04-14 and earlier. The vulnerability can be...

CVE-2018-13038: Unrestricted Upload of File with Dangerous Type

OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type...

Privilege escalation

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...

CVE-2018-13021

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...

CVE-2018-13021

HongCMS 3.0.0 is affected by CVE-2018-13021 due to an Arbitrary Script File Upload vulnerability exploited via admin/index.php/template/upload, enabling PHP code execution. Multiple connected sources (e.g., CNVD-2018-16275, NVD entry) confirm the vulnerability and impact. The root cause is an ins...

CVE-2018-12994

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen...

CVE-2018-12994

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen...

CVE-2018-12995

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen...

CVE-2018-12994: Improper Control of Generation of Code

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen...

CVE-2018-13021: Unrestricted Upload of File with Dangerous Type

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...

PT-2018-11523

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2012-04-14 Description The issue allows attackers to execute arbitrary PHP code via a .php filename on the New File screen. Recommendations For versions prior to 2012-04-14, consider restricting access to the New...

PT-2018-11541

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint. Recommendations For...

CVE-2018-12995: Improper Control of Generation of Code

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen...

PT-2018-11524

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2012-04-14 Description The issue allows attackers to execute arbitrary PHP code via a .php filename on the Upload screen. Recommendations For versions prior to 2012-04-14, consider restricting access to the Upload...