CVE-2017-7694

Symphony CMS

CVE-2017-7694: Improper Control of Generation of Code

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor...

PT-2017-17892

Name of the Vulnerable Software and Affected Versions Symphony CMS versions prior to 2.6.12 Description A Remote Code Execution issue allows remote attackers to execute code and obtain a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or...

Code injection

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

CVE-2017-7625

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

CVE-2017-7625

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

CVE-2017-7625

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

CVE-2017-7625

CVE-2017-7625 affects Fiyo CMS 2.x up to 2.0.7. An attacker can upload a webshell by sending the content parameter to /dapur/apps/app_theme/libs/save_file.php, enabling remote code execution. Multiple sources corroborate the same description (NVD, CNVD, CVE lists). The exact root cause is imprope...

CVE-2017-7625: Improper Control of Generation of Code

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

PT-2017-17853

Name of the Vulnerable Software and Affected Versions Fiyo CMS versions 2.x through 2.0.7 Description The issue allows attackers to upload a webshell via the content parameter to the "/dapur/apps/app theme/libs/save file.php" API endpoint and then execute code. Recommendations For Fiyo CMS versio...

PHPCMS V9.6 WAP Module Arbitrary File Upload Vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. PHPCMS V9.6 WAP module is not strict in filtering file extensions uploaded by front-end users, resulting in an arbitrary file...

Design flaws in the backend of Zendo project management software of Qingdao Easoft Tianchuang Network Technology Co.

Zendo is open source free project management software. Qingdao Easoft Tianchuang Network Technology Co., Ltd Zendo project management software backend there are design flaws vulnerabilities. Allow attackers to use the background sql query function to write webshell and gain server privileges...

Remote Command Execution Vulnerability in Next-Generation Firewall System of SinoCom-ArtM

The InforCube Next-Generation Firewall NFW is a comprehensive security gateway security solution. A remote command execution vulnerability exists in the InforCube Next Generation Firewall system. The vulnerability allows an attacker to write php code into a file by modifying the install.php post...

DjangoUEditor 1.9.143 arbitrary file upload vulnerability

Background improper handling, leading to arbitrary file upload. Local download the django version of ueditor, installed after a good visit: Open the upload, the capture of: Now we pass a py file, you can see is prohibited, as is the white list restrictions. But modify imagePathFormat the value to...

Arbitrary code execution vulnerability in Finecms backend controllers\admin\Sms.php page

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in the Finecms backend controllers\admin\Sms.php page. Since the array2string function does not filter the submitted data, allowing attackers to...

File Upload Vulnerability at Kirin Fortress Application Publishing Feature

Kirin Fortress is the open source operations and maintenance fortress. A file upload vulnerability exists at the application icon upload in the application publishing feature of KyLin Fortress. This allows attackers to upload a webshell and gain server privileges...

Kinsey Infor / Lawson / ESBUS - SQL Injection Vulnerability

Exploit for jsp platform in category web applications Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE:...

Kinsey InforLawson ESBUS - SQL Injection

Kinsey InforLawson ESBUS - SQL Injection Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE: CVE-2017-6550...

Kinsey's Infor-Lawson SQL Injection

Summary: Kinsey's Infor-Lawson application formerly ESBUS is vulnerable to SQL injection in at least two parameters: ------------------------------------------------------------------------ Vendor: Kinsey ------------------------------------------------------------------------ Software Link:...

Arbitrary File Upload Vulnerability in eWebEditor Editor of Fuzhou Extreme Software Development Co.

Fuzhou Extreme Software Development Co. eWebEditor editor is a browser-based online HTML editor. An arbitrary file upload vulnerability exists in the eWebEditor editor of Fuzhou Extreme Software Development Co. Due to logging into the backend via anonymous access or weak account/password...