CVE-2010-5091

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

Code injection

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

CVE-2010-5091

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

Tiki Wiki CMS Groupware jhot.php RCE Vulnerability

Tiki Wiki CMS Groupware is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Plugin Rich Widget - Arbitrary File Upload

WordPress Plugin Rich Widget - Arbitrary File Upload source: https://www.securityfocus.com/bid/55174/info The Rich WidgetPlugin for WordPress is prone to an arbitrary file-upload vulnerability. An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web...

XODA 0.4.5 - Arbitrary '.PHP' File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "XODA 0.4.5...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Gallery 3 before 3.0.4 allow attackers to execute arbitrary PHP code via unknown vectors...

Code injection

The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors...

PBBoard - 'admin.php?xml_name' Arbitrary PHP Code Execution

source: https://www.securityfocus.com/bid/54916/info PBBoard is prone to multiple security vulnerabilities including: 1. Multiple SQL-injection vulnerabilities 2. A security-bypass vulnerability 3. An arbitrary file upload vulnerability Exploiting these issues could allow an attacker to carry out...

CVE-2012-3448

Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors...

Design/Logic Flaw

Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors...

CVE-2012-3448

CVE-2012-3448 is a remote PHP code execution vulnerability in Ganglia Web prior to 3.5.1. The issue arises from insufficient input sanitization in the Ganglia Web interface, enabling an attacker to execute arbitrary PHP code on the web server. Public sources in the connected set confirm the affec...

WordPress Front End Upload v0. 5. 4. 4 arbitrary php file upload-vulnerability warning-the black bar safety net

Title: WordPress Front End Upload v0. 5. 4. 4 Arbitrary PHP File Upload Vulnerability Author: Chris Kellum Home page: http://mondaybynoon.com/ Software address: http://downloads.wordpress.org/plugin/front-end-upload.0.5.4.4.zip Affected version: 0.5.4.4 Defect analysis ===================== Plugi...

WordPress Front End Upload v0.5.4.4 Arbitrary PHP File Upload

Exploit for php platform in category web applications Exploit Title: WordPress Front End Upload v0.5.4.4 Arbitrary PHP File Upload Vulnerability Date: 7/23/12 Exploit Author: Chris Kellum Vendor Homepage: http://mondaybynoon.com/ Software Link:...

WordPress Front End Upload 0.5.4.4 Shell Upload

Exploit Title: WordPress Front End Upload v0.5.4.4 Arbitrary PHP File Upload Vulnerability Date: 7/23/12 Exploit Author: Chris Kellum Vendor Homepage: http://mondaybynoon.com/ Software Link: http://downloads.wordpress.org/plugin/front-end-upload.0.5.4.4.zip Version: 0.5.4.4 =====================...

CVE-2012-1037

PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the subtype parameter...

Code injection

TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the 1 cookieName to lib/banners/bannerlib.php; 2 printpages or 3 printstructures parameter to a tiki-printmultipages.php or b tiki-printpages.php; or 4...

Unrestricted file upload

Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts...

WordPress Foxypress Plugin 'uploadify.php' Arbitrary File Upload Vulnerability

WordPress Foxypress Plugin is prone to file upload vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...