PT-2018-15260

Name of the Vulnerable Software and Affected Versions zzzphp cms version 1.5.8 Description An issue was discovered that allows remote attackers to delete arbitrary files. This is possible due to the del file function in the /admin/save.php endpoint, which can be exploited by using a mixed-case...

PHP Easy Download admin/save.php Paramater Code Injection Vulnerability

The remote web server contains a PHP script that is affected by a remote code execution issue. Description: The version of PHP Easy Download installed on the remote host fails to sanitize input to the 'moreinfo' parameter before using it in the 'save.php' script. By sending a specially-crafted...

CVE-2007-2148: Undefined Security Weakness

Direct static code injection vulnerability in admin/save.php in Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed...