CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

PT-2017-7488

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.8.2 Description The issue allows remote authenticated users with specific permissions to execute arbitrary PHP code by uploading files with certain extensions, including .pht, .phps, and .phtml. This is due to...

CVE-2016-5727: Improper Control of Generation of Code

LogInOut.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop...

CVE-2015-8832: Improper Access Control

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2016-5726: Improper Control of Generation of Code

Packages.php in Simple Machines Forum SMF 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter...

PT-2017-8752

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.1 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter. Recommendations For Simple Machines Forum SMF...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

CVE-2016-6175

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header...

CVE-2016-6175

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header...

CVE-2016-6175

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header...

CVE-2016-6175

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header...

CVE-2016-2539

Cross-site request forgery CSRF vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file...

WordPress InfiniteWP Client 1.5.1.3 / 1.6.0 PHP Object Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability ------------------------------------------------------------------------ Yorick...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

PT-2017-8442

Name of the Vulnerable Software and Affected Versions Magento CE and EE versions prior to 2.0.6 Description The issue allows remote attackers to conduct PHP object injection attacks, enabling them to execute arbitrary PHP code. This is achieved by sending crafted serialized shopping cart data...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...

CVE-2016-7998

The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted 1 INCLUDE or 2 INCLURE tag and then accessing it with a validerxml action...

CVE-2016-7980

Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...