3343 matches found
PT-2020-10000
Name of the Vulnerable Software and Affected Versions Blaauw Remote Kiln Control versions through v3.00r4 Description The issue allows a user to execute arbitrary php code via the "/default.php?idx=17" endpoint. This is due to leftover debug code in the software. Recommendations For versions...
CVE-2019-18869: Undefined Security Weakness
Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17...
CVE-2020-5558
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors...
Code injection
mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors...
Code injection
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors...
PT-2020-18533
Name of the Vulnerable Software and Affected Versions CuteNews version 2.0.1 Description The issue allows remote authenticated attackers to execute arbitrary PHP code. Recommendations For CuteNews version 2.0.1, at the moment, there is no information about a newer version that contains a fix for...
Horde 5.2.22 CSV Import Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Horde CSV import arbitrary PHP code execution', 'Description' = %q The HordeData module version 2.1.4 and before present in Horde Groupware versi...
PT-2020-6652
Name of the Vulnerable Software and Affected Versions PHP versions 5.6.x through 5.6.0 Description The issue is related to a use-after-free vulnerability in the add post var function of the Posthandler component. This vulnerability can be exploited by remote attackers to execute arbitrary PHP cod...
CVE-2013-4211
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code...
Remote code execution
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code...
CVE-2013-4211
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code...
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter...
CVE-2011-4906: Unrestricted Upload of File with Dangerous Type
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...
PT-2020-7142
Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.5.13 Description The issue allows file upload and arbitrary PHP code execution through the Tiny browser in the TinyMCE 3.0 editor. Recommendations For versions prior to 1.5.13, update to version 1.5.13 or later to...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
WordPress Plugin InfiniteWP - Client Authentication Bypass (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress InfiniteWP Client Authentication Bypass', 'Description' = %q This module exploits an authentication bypass in the WordPress InfiniteWP...
Code injection
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...
Code injection
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution...
CVE-2013-3629
CVE-2013-3629 affects ISPConfig 3.0.5.2. The Red Hat/NVD/CVE records and related sources describe an Arbitrary PHP Code Execution vulnerability. The root cause is a flaw in ISPConfig’s content/language handling that allows an authenticated user to cause arbitrary PHP code execution on the server ...