CVE-2015-7712

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7712

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7816

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2015-7816: Undefined Security Weakness

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2014-9752: Undefined Security Weakness

Unrestricted file upload vulnerability in mods/core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course, then accessing it via a direct request to the...

PT-2015-4382

Name of the Vulnerable Software and Affected Versions ATutor versions prior to 2.2 patch 6 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a custom icon for a new course, then accessing it via a direct request to th...

PT-2015-7590

Name of the Vulnerable Software and Affected Versions ATutor versions 2.2 and earlier Description The issue concerns multiple eval injection vulnerabilities. These vulnerabilities allow remote authenticated users with the AT PRIV GRADEBOOK privilege to execute arbitrary PHP code. This can be...

[KIS-2015-04] Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability

------------------------------------------------------------------------------- Magento = 1.9.2 catalogProductCreate Autoloaded File Inclusion Vulnerability ------------------------------------------------------------------------------- - Software Link: http://magento.com/ - Affected Versions:...

CVE-2015-5647

The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866...

CVE-2015-5646: Improper Control of Generation of Code

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867...

PT-2015-7010

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.x through 3.7.5 Cybozu Garoon versions 4.x through 4.0.3 Description The issue in the RSS Reader component allows remote authenticated users to execute arbitrary PHP code. Recommendations For Cybozu Garoon versions 3.x...

Code injection

The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...

Code injection

The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...

PT-2015-7034

Name of the Vulnerable Software and Affected Versions Anchor CMS versions 0.9.x Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie. This is related to the system/session/drivers/cookie.ph...

CVE-2015-5644

CVE-2015-5644 affects ICZ MATCHA SNS prior to 1.3.7. The installer fails to correctly configure the database, enabling a code injection path that allows a remote attacker to execute arbitrary PHP code. The vulnerability is tied to installer-time database configuration (CWE-94) and culminates in c...

Input validation

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

CVE-2015-5074

Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension...

PT-2015-6767

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM versions prior to 5.0.9 Description The issue is related to an incomplete blacklist vulnerability in the FileUploadsFilter class. This allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .p...

Centreon 2.6.1 Unrestricted File Upload Vulnerability

Summary Centreon is the choice of some of the world's largest companies and mission-critical organizations for real-time IT performance monitoring and diagnostics management. Description The vulnerability is caused due to the improper verification of uploaded files via the 'filename' POST...

CVE-2015-6968

Multiple incomplete blacklist vulnerabilities in the serendipityisActiveFile function in include/functionsimages.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .pht or 2 .phtml extension...