WordPress Similar Posts plugin <= 3.1.5 - Arbitrary PHP Code Execution vulnerability

Arbitrary PHP Code Execution vulnerability discovered by bl4derunner in WordPress Similar Posts plugin versions = 3.1.5. Solution Update the WordPress Similar Posts plugin to the latest available version at least 3.1.6...

PT-2021-16066

Name of the Vulnerable Software and Affected Versions EditorsKit WordPress plugin versions prior to 1.31.6 Description The issue allows users with a role as low as contributor to execute arbitrary PHP code due to the lack of sanitization and validation of the Conditional Logic of the Custom...

CVE-2021-24546: Improper Control of Generation of Code

The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code...

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034

This module enables you to extract the textual content of files for use on a website, e.g. to display it or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands that are executed on the server, which leads to post-authentication remote code executio...

CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-18917: Cross-Site Request Forgery (CSRF)

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

PT-2021-22674

Name of the Vulnerable Software and Affected Versions: FlatCore-CMS version 2.0.7 Description: A Remote Code Execution RCE issue exists via the upload addon plugin, allowing a remote malicious user to execute arbitrary PHP code. Recommendations: For FlatCore-CMS version 2.0.7, consider disabling...

PT-2021-10114

Name of the Vulnerable Software and Affected Versions: Twothink version 2.0 Description: A remote code execution issue in the /library/think/App.php file of Twothink allows attackers to execute arbitrary PHP code. Recommendations: For Twothink version 2.0, at the moment, there is no information...

Advantech R-SeeNet File Inclusion Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

PT-2021-3361

Name of the Vulnerable Software and Affected Versions LaikeTui version 3.5.0 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a ZIP archive containing a .php file. This can be achieved by using the "index.php?module=system&action=pay" endpoint to...

PT-2021-3652

Name of the Vulnerable Software and Affected Versions QibosoftX1 version 1.0 Description A code injection issue has been found in the Upgrade function, related to incorrect code generation management in components such as client upgrade edition.php and Upgrade.php. This allows an attacker to...

PT-2021-10430

Name of the Vulnerable Software and Affected Versions: ArticleCMS version 1.0 Description: A File Upload issue exists via the image upload feature at "/admin" by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute...

CVE-2020-13664: Improper Neutralization of Special Elements used in a Command

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to...

Invigo Automatic Device Management Command Injection Vulnerability

Invigo Automatic Device Management ADM is a native management tool for cellular operators that enables them to detect, maintain and manage millions of devices cost-effectively and with a high degree of reliability. A command injection vulnerability exists in /admin/broadcast.php in Invigo Automat...

PT-2020-6286

Name of the Vulnerable Software and Affected Versions Concrete5 versions 8.5.5 and earlier Description The issue is related to the deserialization of untrusted data in the Concrete5 CMS system. The vulnerable code is located within the controllers/single...

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

The Drupal project uses the PEAR ArchiveTar library. The PEAR ArchiveTar library has released a security update that impacts Drupal. For more information please see: CVE-2020-28948 CVE-2020-28949 Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz...

PT-2020-4969

Name of the Vulnerable Software and Affected Versions Drupal Core versions prior to 9.0.8 Drupal Core versions prior to 8.9.9 Drupal Core versions prior to 8.8.11 Drupal Core versions prior to 7.74 Description The issue is related to the improper sanitization of certain filenames on uploaded file...

CVE-2020-27387

An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload which will receiv...

PT-2020-15092

Name of the Vulnerable Software and Affected Versions PluxXml version 5.7 Description The theme edit function in PluxXml is affected by an issue that allows remote attackers to execute arbitrary PHP code. This can be achieved by placing the malicious code into a template, specifically through the...

CVE-2020-18185: Improper Control of Generation of Code

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment...