zzzphp CMS 1.6.1 - Remote Code Execution

Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on: windows/Linux,iis/apache C...

ZZZPHP CMS 1.6.1 Remote Code Execution

Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on: windows/Linux,iis/apache C...

zzzphp CMS 1.6.1 - Remote Code Execution

zzzphp CMS 1.6.1 - Remote Code Execution Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version:...

Webiness Inventory 2.3 Arbitrary File Upload

=========================================================================================== Exploit Title: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload Dork: N/A Date: 10-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload

=========================================================================================== Exploit Title: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload Dork: N/A Date: 10-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

CVE-2019-8347

BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/adminmember.php?action=add&nav=addwebuser&adminpnav=user URI...

CVE-2019-7718

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=?php and admin/databack/bakuptables.php?2=fileputcontents URIs because...

Design/Logic Flaw

Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field...

Magento Community Edition 2.1.x < 2.1.7 / 2.0.x < 2.0.14 Multiple Vulnerabilities

Binary data 700415.prm...

CVE-2019-7567

An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...

CVE-2019-7235

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request...

Cross site scripting

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8...

CVE-2019-6707

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

LimeSurvey < 2.72.4 XSS Vulnerability

LimeSurvey is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later aka Resume later feature to enter an email address, which is mishandled in the admin panel...

CVE-2017-18358

LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later aka Resume later feature to enter an email address, which is mishandled in the admin panel...

CVE-2017-18358

LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later aka Resume later feature to enter an email address, which is mishandled in the admin panel...

CVE-2017-18358

LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later aka Resume later feature to enter an email address, which is mishandled in the admin panel...

PHP Scripts Mall Advance Peer to Peer MLM Script Access Control Error Vulnerability

PHP Scripts Mall Advance Peer to Peer MLM Script is an online MLM Multi-Level Marketing system from PHP Scripts Mall India.Admin Panel is one of the admin panels. An access control error vulnerability exists in PHP Scripts Mall Advance Peer to Peer MLM Script version 1.7.0 in the Admin Panel, whi...

CVE-2019-6126

The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...