CVE-2019-16531

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php...

PT-2019-14689

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.4 Description The issue allows for multiple CSRF problems, which can be demonstrated by modifying the System Settings through the "admin/general.php" endpoint, specifically by exploiting the lack of proper CSRF...

CVE-2019-16531: Cross-Site Request Forgery (CSRF)

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php...

CVE-2019-13973

CVE-2019-13973 affects LayerBB 1.1.3, where the admin/general.php arbitrary file upload is possible because the custom_logo filename suffix is not restricted, allowing a ".php" file. The vulnerability stems from insufficient validation of uploaded logo names, enabling potential remote code execut...

PT-2019-13502

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3 Description The issue allows for arbitrary file upload in the admin/general.php file due to the lack of restriction on the custom logo filename suffix, enabling the use of .php suffixes. Recommendations For LayerBB versio...

CVE-2019-13973: Unrestricted Upload of File with Dangerous Type

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...

Code injection

PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter...

CVE-2017-17909: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter...

PT-2017-15093

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Responsive Realestate Script affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the gplu...

QualiteamXCart远程命令执行漏洞

X-Cart是一款基于PHP的电子商务程序。X-Cart没有充分过滤URI的参数值，远程攻击者可以利用这个漏洞以WEB进程权限执行任意命令。问题存在与'admin/general.php'脚本上，由于对perlbinary参数值缺少充分过滤，提交任意SHELL命令，可导致以WEB进程权限在系统上执行任意命令。 Qualiteam X-Cart3.4.3 厂商补丁：Qualiteam --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.x-cart.com/...