PT-2017-17665

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the config key parameter to the "setup/index.php?action=welcome" URI. Recommendations For MODX...

CVE-2014-8731: Deserialization of Untrusted Data

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot...

CVE-2014-8705

PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter...

PT-2017-6262

Name of the Vulnerable Software and Affected Versions Wonder CMS 2014 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter in the editInplace.php file. Recommendations For Wonder CMS 2014, consider restricting access to the editInplace.php fi...

CVE-2014-8705: Improper Input Validation

PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter...

PT-2017-5895

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.0.0 Description: The issue allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object. This is related to the function call...

PT-2017-16878

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 1.x Form Builder before version 0.8.1.6 Description The issue allows remote attackers to execute PHP code. This is achieved via the cntnt01fbrp forma form template parameter in the admin store form endpoint...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2016-5727

LogInOut.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop...

PT-2017-8752

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.1 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter. Recommendations For Simple Machines Forum SMF...

CVE-2015-8832: Improper Access Control

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

PT-2017-8052

Name of the Vulnerable Software and Affected Versions ATutor versions prior to 2.2.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests, enabling the upload of arbitrary files and execution of arbitrary PHP code. This is achieved...

WordPress CM Download Manager Code Injection (CVE-2014-8877)

Content Management Download Manager for WordPress is prone to remote PHP-code execution vulnerability because it fails to validate user input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. This may aid in further attacks or lead to a full...

Design/Logic Flaw

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010

CVE-2016-4010 affects Magento CE/EE before 2.0.6 and enables unauthenticated remote code execution via crafted serialized shopping cart data, due to a PHP object injection in the checkout/cart flow. OpenVAS and exploit references describe Magento

PT-2017-8442

Name of the Vulnerable Software and Affected Versions Magento CE and EE versions prior to 2.0.6 Description The issue allows remote attackers to conduct PHP object injection attacks, enabling them to execute arbitrary PHP code. This is achieved by sending crafted serialized shopping cart data...

CVE-2016-4010: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...