CVE-2025-15423: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The...

Code injection

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...

CVE-2018-6880

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...

PT-2018-17800

Name of the Vulnerable Software and Affected Versions EmpireCMS versions 6.6 through 7.2 Description The issue allows remote attackers to discover the full path via an array value for a parameter to "class/connect.php". Recommendations For EmpireCMS versions 6.6 through 7.2, update to a version...

CVE-2018-6880: Exposure of Resource to Wrong Sphere

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php...

CVE-2012-5777: Improper Control of Generation of Code

Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template...

PT-2012-6091

Name of the Vulnerable Software and Affected Versions EmpireCMS version 6.6 Description The issue concerns an eval injection vulnerability in the ReplaceListVars function within the template parser, located in e/class/connect.php. This vulnerability allows user-assisted remote attackers to execut...