CVE-2017-12905

CVE-2017-12905 affects Vebto Pixie Image Editor versions 1.4 and 1.7, with a Server-Side Request Forgery in Launderer.php triggered by the url parameter. Exploitation allows remote attackers to disclose information or execute arbitrary code. Multiple sources document SSRF in the Launderer.php flo...

CVE-2017-12905: Server-Side Request Forgery (SSRF)

Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php...

Pixie Image Editor 1.7 Server-Side Request Forgery Vulnerability

Exploit for php platform in category web applications title: Pixie image Editor SSRF vulnerability for CVE-2017-12905 Date: 20/09/2017 Vulnerability TypePSo SSRFServer Side Request Forgery Vendor of ProductPSo vebtoPS"vebto.comPSc Attack TypePSo Remote ImpactPSo Importent AuthorPSoBeiJing Baimaoh...

Vebto Pixie Image Editor Cross-Site Request Forgery Vulnerability

Vebto Pixie Image Editor is an image editor. A cross-site request forgery vulnerability exists in Vebto Pixie Image Editor versions 1.4 and 1.7. A remote attacker can exploit this vulnerability by sending the 'url' parameter to the Launderer.php file to disclose information or execute arbitrary...

Pixie Image Editor 1.7 Server-Side Request Forgery

Pixie image Editor SSRF vulnerability for CVE-2017-12905 title: Pixie image Editor SSRF vulnerability for CVE-2017-12905 Date: 20/09/2017 Vulnerability TypePSo SSRFServer Side Request Forgery Vendor of ProductPSo vebtoPS"vebto.comPSc Attack TypePSo Remote ImpactPSo Importent AuthorPSoBeiJing...

Arbitrary File Upload Vulnerability in Pixie CMS Backend

Pixie CMS is a full-featured and easy-to-use website builder. An arbitrary file upload vulnerability exists in the Pixie CMS backend modfilemanager.php file $multiupload-extensions. An attacker can use this vulnerability to upload arbitrary files and execute arbitrary code...

Pixie CMS 1.04 arbitrary file upload

Pixie CMS 1.04 background the presence of arbitrary file upload vulnerability Vulnerability analysis: In Publish File Manager module you can upload any file View Code /admin/admin/modules/modfilemanager.php $multiupload-extensions = array '. png', '. jpg', '. gif', '. zip', '. mp3', '. pdf', '...

Pixie 1.0.4 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

CVE-2017-7402

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

CVE-2017-7402

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

CVE-2017-7402

Pixie 1.0.4 suffers remote authenticated arbitrary PHP code execution by uploading a double‑extension file (for example, image.jpg.php) via admin/index.php?s=publish&x=filemanager. This bypasses extension checks when Content-Type is image/jpeg. Impact: high/severe (CVSSv3 up to 9.8). Exploit pres...

CVE-2017-7402

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

CVE-2017-7402: Improper Control of Generation of Code

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

Pixie 1.0.4 - Arbitrary File Upload

Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Pixie 1.0.4 Shell Upload

Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Pixie 1.0.4 - Arbitrary File Upload

Pixie 1.0.4 - Arbitrary File Upload Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Pixie cross-site scripting vulnerability (CNVD-2017-04818)

Pixie is an open source lightweight website content management system CMS. The system supports CSS themes, WYSIWYG editors and more. A cross-site scripting vulnerability exists in Pixie version 1.0.4. As the program fails to properly validate user-submitted input. A remote attacker can exploit th...

Pixie cross-site scripting vulnerability (CNVD-2017-04817)

Pixie is an open source lightweight website content management system CMS. The system supports CSS themes, WYSIWYG editors and more. A cross-site scripting vulnerability exists in Pixie version 1.0.4. As the program fails to properly validate user-submitted input. A remote attacker can exploit th...

Pixie cross-site scripting vulnerability (CNVD-2017-04816)

Pixie is an open source lightweight website content management system CMS. The system supports CSS themes, WYSIWYG editors and more. A cross-site scripting vulnerability exists in Pixie version 1.0.4. As the program fails to properly validate user-submitted input. A remote attacker can exploit th...