CVE-2016-3154: Improper Control of Generation of Code

The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

PT-2016-5385

Name of the Vulnerable Software and Affected Versions SPIP versions 2.x through 2.1.18 SPIP versions 3.0.x through 3.0.21 SPIP versions 3.1.x through 3.1.0 Description The issue allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer entites function...

CVE-2015-7773

Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension...

PT-2015-7602

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 2.1.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file without an extension and then renaming it to have a .php extension. This is due to an unrestricted file...

CVE-2015-7773: Undefined Security Weakness

Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension...

CVE-2015-7816

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2015-7816: Undefined Security Weakness

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2014-9752: Undefined Security Weakness

Unrestricted file upload vulnerability in mods/core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the...

CVE-2015-5646: Improper Control of Generation of Code

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867...

CVE-2015-5074

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

PT-2015-6767

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 5.0.9 Description The issue is related to an incomplete blacklist vulnerability in the FileUploadsFilter class. This allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .p...

CVE-2015-6968

Multiple incomplete blacklist vulnerabilities in the serendipityisActiveFile function in include/functionsimages.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .pht or 2 .phtml extension...

PT-2015-7428

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description The issue is related to multiple incomplete blacklist vulnerabilities in the serendipity isActiveFile function, located in include/functions images.inc.php. This allows remote authenticated users...

CVE-2015-6968: Undefined Security Weakness

Multiple incomplete blacklist vulnerabilities in the serendipityisActiveFile function in include/functionsimages.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .pht or 2 .phtml extension...

PT-2015-6953

Name of the Vulnerable Software and Affected Versions Hostmaster Aegir module versions 6.x-2.x before 6.x-2.4 Hostmaster Aegir module versions 7.x-3.x before 7.x-3.0-beta2 Description The issue allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write...

PT-2015-6678

Name of the Vulnerable Software and Affected Versions AudioShare version 2.0.2 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the config'basedir' parameter in the ajax/myajaxphp.php file. Recommendations For AudioShare version 2.0.2, consider restricting...

PT-2015-5994

Name of the Vulnerable Software and Affected Versions mt-phpincgi.php in Hajime Fujimoto mt-phpincgi versions prior to 2015-05-15 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request. This has been exploited in...

PT-2015-4983

Name of the Vulnerable Software and Affected Versions Bomgar Remote Support versions prior to 15.1.1 Description The issue allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts. Recommendations For versions prior to 15.1.1, update to version...

CVE-2015-0935: Improper Control of Generation of Code

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

CVE-2015-1399: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in the fetchView function in the MageCoreBlockTemplateZend class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPa...