CVE-2022-24609

Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/templatemanage.php, an attacker can write an arbitrary shell file...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18329)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9. The...

CVE-2020-10492

CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request...

CVE-2020-10472

Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2018-19520

An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a checkbad function in an attempt to block certain PHP functions such as eval, but does not prevent use of pregreplace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin...

Code Execution Vulnerability in FineCMS Backend

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework. A code execution vulnerability exists in the backend of finecms. An attacker can modify the background html template while injecting arbitrary code, resulting in arbitrary code...

CVE-2017-15872

phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username aka newlogin field...

Design/Logic Flaw

phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username aka newlogin field...

CVE-2017-15872

phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username aka newlogin field...

Magento Web E-Commerce Platform Multiple Vulnerabilities

Magento Web E-Commerce Platform is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-2289

Cross-site scripting XSS vulnerability in admin/templates/default.php in Batavi 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING to admin/index.php...

PHPSurveyor Shell Upload

-= G4eL =- Exploit Title: PHPSurveyor - Shell Upload Exploit Author: G4eL Date: 26/12/2013 Product: PHPSurveyor Official Site: http://www.limesurvey.org/ Risk Level: High /admin/templates.php - File Upload URL SITE = Default directory of PHPSurveyor Example : http://site.com/survey/ File Uploaded...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...

CVE-2008-2981

PHP remote file inclusion vulnerability in admin/templates/templatethumbnail.php in HomePH Design 2.10 RC2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumbtemplate parameter...