WordPress Foxypress Plugin 'uploadify.php' Arbitrary File Upload Vulnerability

WordPress Foxypress Plugin is prone to file upload vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Asset Manager Plugin 0.2 - Arbitrary File Upload

WordPress Asset Manager plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation. Solution Update the plugin...

phpList 2.10.9 - Sajax.php PHP Code Injection

phpList 2.10.9 - Sajax.php PHP Code Injection source: https://www.securityfocus.com/bid/53693/info PHPList is prone to a remote PHP code-injection vulnerability. An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may...

PT-2012-4348

Name of the Vulnerable Software and Affected Versions Joomla Content Editor JCE component versions prior to 2.1 Description The issue allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension. This can be achieved when chunking is set to greater than zero...

PHP 'php-cgi' Information Disclosure Vulnerability

Description PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected...

CVE-2012-0993

Eval injection vulnerability in zp-core/zp-extensions/viewersizeimage.php in ZENphoto 1.4.2, when the viewersizeimage plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewersizeimagesaved cookie...

Sql injection

Eval injection vulnerability in zp-core/zp-extensions/viewersizeimage.php in ZENphoto 1.4.2, when the viewersizeimage plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewersizeimagesaved cookie...

CVE-2012-0993

Eval injection vulnerability in zp-core/zp-extensions/viewersizeimage.php in ZENphoto 1.4.2, when the viewersizeimage plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewersizeimagesaved cookie...

CVE-2012-1205: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter...

CVE-2012-1199: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine BASE 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 BASEpath parameter to baseagmain.php, 2 basedbsetup.php, 3 basegraphcommon.php, 4 basegraphdisplay.php, 5 basegraphform.php, ...

CVE-2012-1200: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the 1 fileType parameter to optimizer/index.php, 2 id parameter to administrator/modules/moduleslist.php, 3 filename parameter to includes/function/gets.php, or 4...

Horde 3.3.12 Backdoor Arbitrary PHP Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Horde 3.3.12...

Horde 3.3.12 Backdoor Arbitrary PHP Code Execution

This module exploits an arbitrary PHP code execution vulnerability introduced as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10. Module Options msf use exploit/multi/http/horde/hrefbackdoor msf undefinedhrefbackdoor show actions ...actions... msf undefinedhrefbackdoor set ACTION msf...

Gentoo Security Advisory GLSA 201201-01 (phpMyAdmin)

The remote host is missing updates announced in advisory GLSA 201201-01. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 201201-01 (phpMyAdmin)

The remote host is missing updates announced in advisory GLSA 201201-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2012-1011

actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTPREFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request ...

CVE-2012-1010

Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory...

PT-2012-3014

Name of the Vulnerable Software and Affected Versions AllWebMenus plugin version 1.1.8 Description The issue allows remote attackers to bypass access restrictions, upload, and execute arbitrary PHP code. This is achieved by setting the HTTP REFERER to a specific value, uploading a ZIP file that...

WordPress Theme Tuner Plugin 'tt-abspath' Parameter Remote File Inclusion Vulnerability

WordPress is prone to a remote file inclusion vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"...

CVE-2011-4337

Static code injection vulnerability in translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable...