334648 matches found
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE. id: CVE-2024-58136 info: name: Yii2 PHP Framework 2.0.52 - Remote Code Execution author:...
Likeshop < 2.5.7.20210311 - Arbitrary File Upload
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...
SPIP BigUp Plugin - Remote Code Execution
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...
Veeam Backup & Replication - Unauthenticated
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...
PhpColl 2.5.1 Arbitrary File Upload
PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logosclients/ via clients/editclient.php. id: CVE-2017-6090 info: name: PhpColl 2.5.1 Arbitrary File Uplo...
WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...
Adobe Commerce (Magento) - Remote Code Execution
Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution. id: CVE-2022-24086 info: name:...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell Patches the PHP inside a UISP server against...
CVE-2026-96355
The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to Code Injection due to improper neutralization of special elements used in a template engine. The module fails to sufficiently exclude specific format templates from token replacement, allowing an attacker to...
CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...
CVE-2026-96375 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle AiTM. This issue affects Cloud versions: from 0.0.0 to 7.0.1...
CVE-2026-96375
The Drupal Cloud module (versions 0.0.0 to 7.0.1 ) is vulnerable to Improper Certificate Validation (CWE-295). The Kubernetes and VMware integrations fail to properly validate TLS certificates when connecting to remote API endpoints. This allows an Adversary in the Middle (AiTM) to intercept conn...
CVE-2026-96375 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle AiTM. This issue affects Cloud versions: from 0.0.0 to 7.0.1...
CVE-2026-96376 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1...
CVE-2026-96376
The Drupal Cloud module (versions 0.0.0 to 7.0.1 ) is vulnerable to OS Command Injection due to insufficient sanitization of user-controlled Git branch and repository URL values. These values are passed to shell commands within the Kubernetes integration , potentially allowing an attacker to exec...
CVE-2026-96376 Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php-patch-verify A portable Agent Skill that checks wheth...