926 matches found
CVE-2026-86305 light0011 cms Upload.class.php upload unrestricted upload
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...
PT-2026-86784
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...
CVE-2026-86305: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...
CVE-2026-71232
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...
CVE-2026-71232 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...
EUVD-2026-53305
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...
CVE-2026-71232
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...
CVE-2026-71232 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...
PT-2026-68098
Name of the Vulnerable Software and Affected Versions MacCMS10 affected versions not specified Description The admin template editor in application/admin/controller/Template.php uses a blacklist regex to block dangerous PHP functions in template content. However, the blacklist fails to include...
ThinkPHP 5.0.23 - Remote Code Execution Detection
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. !/usr/bin/env python3 -- coding: utf-8 --...
ThinkPHP 2/3 - Remote Code Execution Detection
ThinkPHP 2.x and 3.0 in Lite mode are susceptible to remote code execution via the s parameter. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding:...
ThinkPHP 5.0.23 - Remote Code Execution Detection
ThinkPHP 5.0.23 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from...
ThinkPHP 5.0.9 - Information Disclosure Detection
ThinkPHP 5.0.9 includes verbose SQL error message that can reveal sensitive information including database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...
ThinkPHP 5.0.1 - Remote Code Execution Detection
ThinkPHP 5.0.1 allows remote unauthenticated attackers to execute arbitrary code via the 's' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ThinkPH...
ThinkPHP Errors - Sensitive Information Exposure Detection
ThinkPHP error is leaking sensitive info. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP error is leaking sensitive info.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ThinkPHP Errors - Sensitive Information...
ThinkPHP 5.0.24 - Information Disclosure Detection
ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINFO parameter. This can allow an attacker to access all system environment parameters from index.php, thereby possibly obtaining sensitive information, modifying data, and/or executing...
Thinkphp Lang - Local File Inclusion Detection
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...
ThinkPHP Detection
Detects ThinkPHP routing errors and framework markers without exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ThinkPHP framework fingerprints safe passive probes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
VulnCheck KEV: CVE-2018-25270
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system...
