CVE-2022-25487

Atom CMS v2.0 contains a remote code execution (RCE) vulnerability exploitable via /admin/uploads.php. The Nuclei template and CIRCL/CVE records confirm the issue stems from improper handling in the uploads path, enabling arbitrary code execution on the affected system. Impact is described as ful...

CVE-2022-25498

CVE-2022-25498 affects CuppaCMS v1.0, where a remote code execution (RCE) exists via the saveConfigData function in /classes/ajax/Functions.php. The Red Hat/CNVD/CVE mirrorings confirm an RCE in CuppaCMS with this entry, but no vendor patch/version is specified in the provided connected documents...

CVE-2022-0944

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...

CVE-2022-0944 Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...

CVE-2022-0944

CVE-2022-0944 affects the SQLPad project (SQLPad, prior to 6.10.1). The vulnerability arises from template injection in the connection test endpoint, enabling remote code execution (RCE) with the privileges of the SQLPad process. Affected versions are SQLPad ≤ 6.10.0. Several public exploit PoCs ...

CVE-2022-0944 Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...

CVE-2022-0944: Improper Neutralization of Special Elements Used in a Template Engine

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...

CVE-2022-25487: Unrestricted Upload of File with Dangerous Type

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php...

SPIP < 3.2.14, 4.x < 4.0.5 Multiple Vulnerabilities

SPIP is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

Exploit for Code Injection in Digitaldruid Hoteldruid

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache2 2.4.49 - LFI & RCE Exploit Info...

CVE-2021-25003

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...

CVE-2021-25003

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...

Design/Logic Flaw

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...

CVE-2021-25003 WPCargo < 6.9.0 - Unauthenticated RCE

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...

CVE-2021-25003

The CVE-2021-25003 vulnerability affects WordPress WPCargo Track & Trace plugin prior to version 6.9.0. A crafted file in the plugin can allow an unauthenticated attacker to write a PHP file anywhere on the web server, enabling remote code execution (RCE). The issue is documented as unauthenticat...

MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution

The plugin allows a high privileged user to bypass the DISALLOWFILEEDIT and DISALLOWFILEMODS settings and upload arbitrary files to the site through the "ajaxsave" function. The file is written relative to the current theme's stylesheet directory, and a .php file extension is added. No validation...

CVE-2021-25003: Improper Control of Generation of Code

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache2 2.4.49 - LFI & RCE Exploit Info...

CVE-2022-24760

Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution RCE vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution...