CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

PT-2017-19175

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.10.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via the database username, database host, or database password parameter in the install/save.php file. Recommendation...

CVE-2017-8402

PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file...

CVE-2017-8402: Improper Control of Generation of Code

PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file...

OV3 Online Administration 3.0 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications !-- OV3 Online Administration 3.0 Authenticated Code Execution Vendor: novaCapta Software & Consulting GmbH Product web page: http://www.meacon.de Affected version: 3.0 Summary: With the decision to use the OV3 as a platform for your data...

PT-2017-18323

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved through vectors involving the upload of a .htaccess file. Recommendations For PivotX version 2.3.11, consider...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution

This module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage' method allowi...

PT-2017-18691

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4 Description The issue allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. This is caused by a combination of Unrestricted File Upload and Code Injection in the sendfromfile.ph...

Nippon Institute of Agroinformatics SOY CMS Directory Traversal Vulnerability

Nippon Institute of Agroinformatics SOY CMS is a web content management system CMS from Nippon Institute of Agroinformatics, Japan. The system supports the creation of websites, the development of software based on A/B testing, and the optimization of websites. A directory traversal vulnerability...

MODX CMS 2.x < 2.5.7 Multiple Vulnerabilities

MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; if description...

CVE-2016-4876: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors...

PT-2017-8573

Name of the Vulnerable Software and Affected Versions baserCMS versions 3.0.10 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators, potentially leading to the execution of arbitrary PHP code. Recommendations For...

SyntaxHighlight 2.0 MediaWiki 1.28.0 Stored Cross Site Scripting Vulnerability

A vulnerability was found in the SyntaxHighlight MediaWiki extension. Using this vulnerability it is possible for an anonymous attacker to pass arbitrary options to the Pygments library. By specifying specially crafted options, it is possible for an attacker to trigger a stored cross site scripti...

phpMyAdmin 4.6.x < 4.6.3 Multiple Vulnerabilities (PMASA-2016-17 - PMASA-2016-28)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.6.x prior to 4.6.3. It is, therefore, affected by the following vulnerabilities: - A flaw exists in the setup/frames/index.inc.php script that allows an unauthenticated, remote attacker ...

October CMS 1.0.412 - Multiple Vulnerabilities

October CMS 1.0.412 - Multiple Vulnerabilities October CMS v1.0.412 several vulnerabilities Information =========== Name: October CMS v1.0.412 build 412 Homepage: http://octobercms.com Vulnerability: several issues, including PHP code execution Prerequisites: attacker has to be authenticated user...

October CMS 1.0.412 - Multiple Vulnerabilities

October CMS v1.0.412 several vulnerabilities Information =========== Name: October CMS v1.0.412 build 412 Homepage: http://octobercms.com Vulnerability: several issues, including PHP code execution Prerequisites: attacker has to be authenticated user with media or asset management permission CVE:...

CVE-2016-4862

Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers...

CVE-2016-4862

The CVE-2016-4862 issue affects the Twigmo add-on shipped with CS-Cart v4.3.9 and earlier (and CS-Cart Multi-Vendor v4.3.9 and earlier). The vulnerability is a PHP object injection flaw caused by unserializing untrusted input in Twigmo, enabling a remote authenticated user to execute arbitrary PH...

PT-2017-8559

Name of the Vulnerable Software and Affected Versions CS-Cart versions 4.3.9 and earlier CS-Cart Multi-Vendor versions 4.3.9 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code on the servers. Recommendations For CS-Cart versions 4.3.9 and earlier,...

October CMS 1.0.412 Code Execution / Shell Upload Vulnerabilities

Exploit for php platform in category web applications October CMS v1.0.412 several vulnerabilities Information =========== Name: October CMS v1.0.412 build 412 Homepage: http://octobercms.com Vulnerability: several issues, including PHP code execution Prerequisites: attacker has to be authenticat...