File upload vulnerability in zzzcms V1.7.1 version

zzcms is an asp language development of the site building system. A file upload vulnerability exists in zzzcms V1.7.1, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in the mi***.php File of S-CMS Enterprise Website Builder System

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. S-CMS enterprise website builder system mi.php file there is a command execution vulnerability, an attacker can use the vulnerabilit...

Code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17282)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

File Upload Vulnerability in EyouCms Backend

Eyou Content Management System EyouCms is developed by php + mysql a set of open source CMS dedicated to small and medium-sized enterprise website construction. EyouCms backend file upload vulnerability , attackers can use the vulnerability to obtain control of the web server...

Command Execution Vulnerability in HYBBS Frontend

HYBBS is a MVC-structured program based on HYPHP framework. A command execution vulnerability exists in the frontend of HYBBS, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in Ebay CMS Single Page System

Single page system is an official extension application for setting up a single page system, supporting template tags, php code, and support for setting it as the home page. Ebay CMS Single Page System has a command execution vulnerability that can be exploited by attackers to gain control of the...

Code execution vulnerability in OURPHP backend (CNVD-2018-23349)

OURPHP is Harbin Weicheng Technology Co., Ltd. developed a PHP + MySQL based on the development of W3C standards-compliant building system. OURPHP backend code execution vulnerabilities, attackers can use the vulnerability to obtain control of the web server...

Code Execution Vulnerability in ThinkSNS V4

ThinkSNS is an open source social system under Wise Software Beijing Co. A code execution vulnerability exists in ThinkSNS V4, which can be exploited by an attacker to gain control of the web server...

Code execution vulnerability in weiPHP

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. A code execution vulnerability exists in weiPHP versions 3.0 and 4.0, which can be exploited by attackers to gain control of a web server...

File Upload Vulnerability in N5 Version of Nanjung Exam System

Nanqiong Exam System is a new generation of pure B/S architecture general network examination system designed for enterprises, government organizations and educational units. Nanqiong exam system N5 version in the user to modify the personal data upload personal avatar at the file upload...

OS Command Injection & Reflected Cross Site Scripting in OpenEMR

Vendor description: ------------------- "OpenEMR is the most popular open source electronic health records and medical practice management solution. ONC certified with international usage, OpenEMR's goal is a superior alternative to its proprietary counterparts." Source: http://www.open-emr.org/...

CVE-2017-1000235

I, Librarian version =4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised...

I, Librarian OS Command Injection Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. An operating system command injection vulnerability exists in the batchimport.php file in Scilico I, Librarian versions 4.6 and earlier and 4.7. An attacker can exploit the vulnerability to...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

SOA - School Management System 3.0 Shell Upload

======================================================== SOA - School Management System 3.0 - Arbitary file upload Description : attacker who has access to the administrative panel can upload arbitray file which may lead to total compromise of the web server Proof of Concept : -...

File upload vulnerability in SchoolCMS backend ThemeController.class.php

SchoolCMS is an open source faculty management system. SchoolCMS v2.3.1 version ThemeController.class.php and SiteController.class.ph Upload function in the file upload vulnerability, remote attackers can use the theme function in the background, to perform arbitrary file write operations to obta...

I_ Librarian 4.6/4.7 - Command Injection / Server Side Request Forgery / Directory Enumeration / Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

WordPress CM Download Manager Code Injection (CVE-2014-8877)

Content Management Download Manager for WordPress is prone to remote PHP-code execution vulnerability because it fails to validate user input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. This may aid in further attacks or lead to a full...

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

A security researcher recently reported a critical vulnerability in one of the most popular open source PHP libraries used to send emails that allowed a remote attacker to execute arbitrary code in the context of the web server and compromise a web application. Disclosed by Polish security...

SQL Injection and RCE in WebsiteBaker

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in WebsiteBaker CMS. A remote attacker will be able to read, write or modify arbitrary information in the database, gain complete control over the vulnerable web application and even the entire web server on which the...