JVN#78151490: Multiple vulnerabilities in baserCMS

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. SQL injection CWE-89 - CVE-2017-10842 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L| Base Score: 7.3 CVSS v2| AV:N/AC:L/Au:N/C:P/I:P/A:P| Base Score: 7.5...

JVN#87410770: Multiple vulnerabilities in "Dokodemo eye Smart HD" SCR02HD

Wireless monitor "Dokodemo eye Smart HD" SCR02HD provided by NIPPON ANTENNA Co., Ltd contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2017-10832 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2|...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution Exploit

This Metasploit module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage'...

CVE-2017-11760

uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area...

CVE-2017-11760

uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area...

PT-2017-12227

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 6.3.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data. This can be achieved by uploading the malicio...

PT-2017-12224

Name of the Vulnerable Software and Affected Versions Earcms Ear Music versions prior to 4.1 build 20170710 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by modifying the allowable music-upload extensions in admin.php?iframe=config...

CVE-2017-11756: Unrestricted Upload of File with Dangerous Type

In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...

CVE-2017-11715: Improper Control of Generation of Code

job/uploadfilesave.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php...

PT-2017-12195

Name of the Vulnerable Software and Affected Versions MetInfo versions prior to 5.3.18 Description The issue allows remote authenticated admins to potentially execute arbitrary PHP code by uploading a file with a specific extension. This is possible because the software blocks the .php extension...

PT-2017-12167

Name of the Vulnerable Software and Affected Versions ZenCart version 1.5.5e Description The issue arises from the traverseStrictSanitize function in admin dir/includes/classes/AdminRequestSanitizer.php, which mishandles key strings. This allows remote authenticated users to execute arbitrary PHP...

CVE-2017-11585

CVE-2017-11585 affects dayrui FineCMS 5.0.9 with remote PHP code execution through the param parameter in an action=cache request to libraries/Template.php, described as Eval Injection. The vulnerability allows an attacker to inject and execute arbitrary PHP code on the server. Exploitation and e...

CVE-2017-11585: Improper Control of Generation of Code

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

PT-2017-12120

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns remote PHP code execution via the param parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection. Recommendations For FineCms version 5.0.9,...

CVE-2015-3638: Improper Control of Generation of Code

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configurati...

PT-2017-6686

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions 2.5 and earlier Description The issue allows remote authenticated users to inject and execute arbitrary PHP scripts by exploiting the lack of proper escaping of the "." character in request parameters. This can be...

PT-2017-11791

Name of the Vulnerable Software and Affected Versions FineCMS version 2.1.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using a URL Manager "Add Site" action and entering the code after a ' sequence in a domain name. For example, using the...

PT-2017-11645

Name of the Vulnerable Software and Affected Versions FineCMS through 2017-07-07 Description The issue allows remote PHP code execution. This can be achieved by placing the code after "?php" in a route=template request, specifically in the application/core/controller/template.php file...

CVE-2017-10968: Improper Control of Generation of Code

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...

GShark Framework - Check all your backdoors with only one telegram account

This framework can perform web post exploitation, with this you can interact with multiple web backdoor and execute custom module, script. Check all your backdoors with only one telegram messenger account! Connect web backdoor to master server and control it with Telegram Download visual backdoor...