CVE-2014-5362

CVE-2014-5362 affects LANDESK/Landesk Management Suite 9.6 and earlier. The admin interface is vulnerable to remote file inclusion via insufficient input validation, exploitable by crafting requests that set the d parameter in ldms/sm_actionfrm.asp or remote/frm_coremainfrm.aspx, or the top param...

CVE-2014-5362

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

SugarCRM Remote File Inclusion Vulnerability

SugarCRM Professional is a professional version of an open source customer relationship management system CRM from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...

CVE-2017-14509

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

Input validation

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

CVE-2017-14509

SugarCRM CVE-2017-14509 concerns a remote file inclusion in the Connectors module of SugarCRM (versions prior to 7.7.2.3, 7.8.x before 7.8.2.2, 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26) exploitable by authenticated users via module=CallRest&url= in the query string. The issue arise...

sugarcrm -- multiple vulnerabilities

sugarcrm developers report: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection,...

AlegroCart Arbitrary Code Execution Vulnerability

AlegroCart is an open source online business solution from the Canadian ALEGROCART team. AlegroCart version 1.2.8 has a remote file inclusion vulnerability in the 'getfile' function of the upload/admin2/controller/reportlogs.php file, which stems from the program failing to detect the 'filepath'...

WordPress Gwolle Guestbook Plugin < 1.5.4 RFI Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112042";...

Directory traversal

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

Remote file inclusion

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

CVE-2015-9227

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

CVE-2015-8351

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

CVE-2015-9227

CVE-2015-9227 affects AlegroCart 1.2.8. The get_file function in upload/admin2/controller/report_logs.php is vulnerable to remote file inclusion, allowing an attacker to execute arbitrary PHP code via a URL provided in the file_path parameter. Public references (e.g., Exploit-DB) document exploit...

CVE-2015-8351

CVE-2015-8351 affects the WordPress Gwolle Guestbook Plugin prior to 1.5.4. The vulnerability is a PHP Remote File Inclusion via the abspath parameter to frontend/captcha/ajaxresponse.php, which can be exploited by remote authenticated users to execute arbitrary PHP code. The issue can also be le...

Unikrn: Persistent XSS found on bin.pinion.gg due to outdated FlowPlayer SWF file with Remote File Inclusion vulnerability.

Description Hi. Today i looked to some outscope subdomains .pinion.gg for recon purposes. I discovered an interesting file on http://templ4d2.pinion.gg/motd2.manifest with next content: CACHE MANIFEST 2014-07-07 CACHE: http://bin.pinion.gg/bin/companions.min.js...

Remote File Inclusion

Magento is vulnerable to remote file inclusion. The vulnerability is possible because the fetchView function in the MageCoreBlockTemplateZend class does not enforce security mechanisms, allowing an authenticated administrator to execute arbitrary PHP code on the web server...

CVE-2016-9710

CVE-2016-9710 : IBM Predictive Solutions Foundation (PMQ) in IBM Cognos BI Server is described as allowing a remote attacker to include arbitrary files by sending a crafted URL that selects a local file, potentially exposing sensitive information. This is evidenced in the NVD entry and IBM securi...

FeiWa B2B2C mall system url parameter has remote file inclusion vulnerability

Flying Frog Mall System FeiWa B2B2C is an enterprise-level B2B2C e-commerce platform system, fully supporting PC, WAP, WeChat, APP and other terminal equipment. FeiWa B2B2C mall system url parameters exist remote file containment vulnerability. The vulnerability exists in the location "...

HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion Vulnerabilit

Exploit for multiple platform in category web applications Source: https://blogs.securiteam.com/index.php/archives/3087 SSD Advisory – HPE OpenCall Media Platform OCMP Multiple Vulnerabilities Want to get paid for a vulnerability similar to this one? Contact us at: email protected Vulnerabilities...