Lucene search
+L

81 matches found

Kitploit
Kitploit
added 2026/09/13 3:20 p.m.8 views

CVE-2023-46304

CVE-2023-46304 VTiger 开源 CRM v7.5 中的认证远程代码执行漏洞 摘要 当前发行的 VTiger CRM 开源版本 7.5.0 的 Users 模块中存在一个漏洞,允许经过认证的攻击者向 config.inc.php 写入并执行任意 PHP 代码。 漏洞详情 当用户正常认证到 VTiger 时,系统会检查其设置状态,以判断是否为尚未完全配置的新用户。同时也会检查是否为第一个用户(即应配置某些全局属性的管理员)。如果是,则会被重定向到 Users 模块中的 UserSetup 操作。 root@kitploit: $userSetupStatus =...

8.1CVSS6.5AI score0.01658EPSS
SaveExploits1
NVD
NVD
added 2026/09/04 3:17 a.m.10 views

CVE-2026-85401

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

6.5CVSS0.0025EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/09/04 2:45 a.m.39 views

CVE-2026-85401 Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

6.5CVSS0.0025EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/04 2:45 a.m.10 views

CVE-2026-85401 Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

5.3CVSS5.3AI score
SaveExploits0References11
CVE
CVE
added 2026/09/04 2:45 a.m.17 views

CVE-2026-85401

CVE-2026-85401 affects Dolibarr (versions up to 21.0.4, 22.0.5, and 23.0.3) in the Legacy File Manager component, specifically in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. The vulnerability is an improper access control flaw exploitable remotely with low privileges, yield...

6.5CVSS6.2AI score0.0025EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/09/04 2:45 a.m.10 views

EUVD-2026-70872

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The...

6.5CVSS5.5AI score0.0025EPSS
SaveExploits0References9
EUVD
EUVD
added 2025/10/07 12:30 a.m.12 views

EUVD-2007-5084

Malware in sbrugna...

6.8CVSS6.4AI score0.01353EPSS
SaveExploits0References4
OSV
OSV
added 2024/04/30 1:15 p.m.11 views

CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

8.1CVSS6AI score0.01658EPSS
SaveExploits1References4
CVE
CVE
added 2024/04/30 12:00 a.m.76 views

CVE-2023-46304

Vtiger CRM 7.5.0 contains a vulnerability in modules/Users/models/Module.php where an unprotected endpoint allows a remote authenticated attacker to write arbitrary PHP code to config.inc.php, which is then executed on every page load. The issue enables remote code execution by leveraging this pa...

8.1CVSS6.9AI score0.01658EPSS
SaveExploits1References4Affected Software1
Prion
Prion
added 2023/10/02 8:15 p.m.30 views

Code injection

Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content...

6.5CVSS8.9AI score0.01426EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist
added 2023/10/02 12:00 a.m.49 views

CVE-2023-43835

Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content...

9.2AI score0.01426EPSS
SaveExploits1References1
zdt
zdt
added 2023/09/19 12:00 a.m.436 views

Super Store Finder 3.7 Remote Command Execution Vulnerability

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

7.1AI score
SaveExploits0
Packet Storm
Packet Storm
added 2023/09/19 12:00 a.m.495 views

Super Store Finder 3.7 Remote Command Execution

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

7.1AI score
SaveExploits0
SUSE CVE
SUSE CVE
added 2023/02/15 6:07 a.m.8 views

SUSE CVE-2008-3457

Cross-site scripting XSS vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify...

2.6CVSS6AI score0.01804EPSS
SaveExploits2References4
CNVD
CNVD
added 2021/08/10 12:00 a.m.44 views

rConfig SQL Injection Vulnerability (CNVD-2021-61757)

rConfig is an open source network device configuration management utility. rConfig version 3.9.5 contains a SQL injection vulnerability in config.inc.php, which can be exploited by sending a specially crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php to access sensitive database...

7.5CVSS3AI score0.01558EPSS
SaveExploits1References1
OSV
OSV
added 2021/08/09 11:15 p.m.16 views

CVE-2020-23150

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

7.5CVSS5.8AI score0.01558EPSS
SaveExploits1References1
NVD
NVD
added 2021/08/09 11:15 p.m.19 views

CVE-2020-23150

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

7.5CVSS0.01558EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2021/08/09 10:54 p.m.42 views

CVE-2020-23150

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

8.1AI score0.01558EPSS
SaveExploits1References1
CNVD
CNVD
added 2019/03/29 12:00 a.m.13 views

Nagios XI Elevation of Privilege Vulnerability (CNVD-2019-10018)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An elevation of privilege vulnerability exists in Nagios XI versions prior to 5.5.11. A local attacker can exploit this vulnerability ...

7.8CVSS6.9AI score0.01237EPSS
SaveExploits2References1
Positive Technologies
Positive Technologies
added 2019/03/28 12:00 a.m.12 views

PT-2019-19407 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions prior to 5.5.11 Description: The issue allows local attackers to elevate privileges to root. This is achieved through write access to specific files, including config.inc.php and import xiconfig.php. Recommendations: For...

7.8CVSS8AI score0.01237EPSS
SaveExploits2References4
Rows per page
Query Builder