CVE-2026-120349

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

EUVD-2026-115071

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349

A security flaw exists in dayrui XunRuiCMS up to version 4.7.4 within the Mobile Site Directory component. The vulnerability is located in the str_replace function of the file /var/www/html/zzmob/index.php, where manipulating the dirname argument leads to code injection . This flaw can be exploit...

CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

PT-2026-135338

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349: dayrui XunRuiCMS: A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-65754

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65754

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65754

The Joomla Extension - regularlabs.com - ReReplacer Pro extension contains an insecure path handling vulnerability. The ReReplacer XML include paths can be manipulated to read files located outside the site directory. This flaw allows for unauthorized file access beyond the intended directory sco...

EUVD-2026-47908

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65712

The Joomla Pro extension by regularlabs.com is vulnerable to insecure path handling within its CDN functionality. The root cause is that CDN versioning can check file paths located outside the designated site directory. This flaw allows an attacker to verify the existence of local files and acces...

PT-2026-63611

ReReplacer XML include paths could read files outside the site directory...

CVE-2026-6070 WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is...

EUVD-2026-40908

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is...

EUVD-2007-4241

Malware in sbrugna...

USN-4552-3 pam-python regression

USN-4552-1 and USN-4552-2 fixed a vulnerability in Pam-python. The update introduced a regression which prevented PAM modules written in Python from importing python modules from site-specific directories. We apologize for the inconvenience. Original advisory details: Malte Kraus discovered that...

CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...

PT-2014-4771

Name of the Vulnerable Software and Affected Versions Orbit Open Ad Server versions prior to 1.1.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the site directory sort field parameter to the "guest/site directory" API endpoint...