CVE-2017-14146

HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory...

PT-2017-13279

Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading a .php attachment and then requesting it in the "helpdezkappuploadshelpdezkattachments" directory...

CVE-2014-8677

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

Cross site request forgery (csrf)

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-14050

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

CVE-2017-14050

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

BlackCat CMS Arbitrary PHP Code Injection Vulnerability (CNVD-2017-24887)

BlackCat CMS is a PHP5, HTML5 content management system. BlackCat CMS suffers from an arbitrary PHP code injection vulnerability that allows remote authenticated users to inject arbitrary PHP code into info.php via the newmodulename parameter of specially crafted backend/addons/ajaxcreate.php...

PT-2017-13224

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file. This is possible through the backend/addons/install.php endpoint. Recommendations For...

PT-2017-6255

Name of the Vulnerable Software and Affected Versions SOPlanning versions 1.32 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code via a crafted database name, given certain conditions such as access to an existing database, permissions to create...

CVE-2017-14050: Unrestricted Upload of File with Dangerous Type

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

CVE-2017-10844: Improper Control of Generation of Code

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors...

JVN#78151490: Multiple vulnerabilities in baserCMS

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. SQL injection CWE-89 - CVE-2017-10842 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L| Base Score: 7.3 CVSS v2| AV:N/AC:L/Au:N/C:P/I:P/A:P| Base Score: 7.5...

JVN#87410770: Multiple vulnerabilities in "Dokodemo eye Smart HD" SCR02HD

Wireless monitor "Dokodemo eye Smart HD" SCR02HD provided by NIPPON ANTENNA Co., Ltd contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2017-10832 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2|...

IBM OpenAdmin Tool - SOAP welcomeServer PHP Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution', 'Description' = %q This module exploits an unauthenticated remote PHP code execution...

CVE-2017-11154

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

PT-2017-11779

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.3-3432 Synology Photo Station versions prior to 6.3-2967 Description The issue allows remote attackers to create arbitrary PHP scripts. This is achieved via the type parameter in the...

Design/Logic Flaw

uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area...

PT-2017-12227

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 6.3.2 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data. This can be achieved by uploading the malicio...

Code injection

In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...

CVE-2017-11756

In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...