PT-2017-18323

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved through vectors involving the upload of a .htaccess file. Recommendations For PivotX version 2.3.11, consider...

CVE-2017-8402: Improper Control of Generation of Code

PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file...

CVE-2016-4876

Cross-site request forgery CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors...

Design/Logic Flaw

DISPUTED CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug."...

CVE-2017-8912

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

CVE-2017-8912

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

PT-2017-18617 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.1.6 Description: The issue allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to "admin/editusertag.php", related to the CreateTagFunction and CallUserTag functions. The...

PT-2017-8573

Name of the Vulnerable Software and Affected Versions baserCMS versions 3.0.10 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators, potentially leading to the execution of arbitrary PHP code. Recommendations For...

PT-2017-8559

Name of the Vulnerable Software and Affected Versions CS-Cart versions 4.3.9 and earlier CS-Cart Multi-Vendor versions 4.3.9 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code on the servers. Recommendations For CS-Cart versions 4.3.9 and earlier,...

Code injection

PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension such as .jpg and then invoking the duplicate function to change to the .php extension...

PT-2017-17806

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11 Description The issue allows remote authenticated Advanced users to execute arbitrary PHP code. This can be achieved by uploading a file with a safe extension, such as .jpg, and then using the duplicate function to change...

CVE-2017-7570: Improper Control of Generation of Code

PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension such as .jpg and then invoking the duplicate function to change to the .php extension...

CVE-2017-7447

HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...

Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

CVE-2017-7402

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

PT-2017-17711

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by sending a POST request to the "admin/index.php?s=publish&x=filemanager" endpoint with a filename that has...

Code injection

setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the configkey parameter to the setup/index.php?action=welcome URI...

CVE-2017-7324

MODX Revolution 2.5.4-pl and earlier are affected by a remote code execution vulnerability in setup/templates/findcore.php, exploitable via the core_path parameter to run arbitrary PHP code. The issue is documented across multiple sources (NVD/CVE-2017-7324, CNVD, osv), indicating the vulnerable ...

PT-2017-17665

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the config key parameter to the "setup/index.php?action=welcome" URI. Recommendations For MODX...