WordPress Photo Gallery Unrestricted File Upload

Photo Gallery Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the photo-gallery\photo-gallery.php script allows access to filemanager\UploadHandler.php. The post method in UploadHandler.php does not properly verify or...

CVE-2014-8350

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "literal" in a template...

CVE-2014-8081

lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filterresultresult parameter...

PT-2014-8405

Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.13 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter result result parameter in the lib/execute/execSetResults.php file...

CVE-2014-8081: Improper Control of Generation of Code

lib/execute/execSetResults.php in TestLink before 1.9.13 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filterresultresult parameter...

Code injection

EGroupware Enterprise Line EPL before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the calluserfunc PHP function, as demonstrated using th...

CVE-2014-2988

EGroupware Enterprise Line EPL before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the calluserfunc PHP function, as demonstrated using th...

PT-2014-2061

Name of the Vulnerable Software and Affected Versions WordPress version 0.70 Description A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the abspath variable. Recommendations For WordPress version 0.70, update to a newer version to mitigate the risk. As a...

PT-2014-5005

Name of the Vulnerable Software and Affected Versions EGroupware Enterprise Line EPL versions prior to 1.1.20140505 EGroupware Community Edition versions prior to 1.8.007.20140506 EGroupware versions prior to 14.1 beta Description The issue allows remote authenticated administrators to execute...

CVE-2003-1599: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in EGroupware Enterprise Line EPL before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that 1 create an...

PT-2014-5004

Name of the Vulnerable Software and Affected Versions EGroupware Enterprise Line EPL versions prior to 1.1.20140505 EGroupware Community Edition versions prior to 1.8.007.20140506 EGroupware versions prior to 14.1 beta Description The issue allows remote attackers to hijack the authentication of...

Wordpress Creative Contact Form Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Creative Contact Form version 0.9.7. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/creativecontactformfileupload msf...

Croogo 2.0.0 Arbitrary PHP Code Execution Exploit

Summary Croogo is a free, open source, content management system for PHP, released under The MIT License. It is powered by CakePHP MVC framework. Description Croogo suffers from an authenticated arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded...

Wordpress InfusionSoft Plugin Upload Vulnerability

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::HTTP::Wordpress include...

Wordpress InfusionSoft Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wordpress InfusionSoft Upload Vulnerability', 'Description' = %q This module exploits an arbitrary PHP code upload in the wordpress...

CVE-2014-5324

Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file...

Unrestricted file upload

Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file...

CVE-2014-5324

Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file...

PT-2014-6408

Name of the Vulnerable Software and Affected Versions N-Media file uploader plugin versions prior to 3.4 Description The issue allows remote authenticated users with Author privileges to execute arbitrary PHP code by uploading files. This can be achieved by leveraging the file upload functionalit...