49 matches found
Drupal 7 Elfinder - Unauthenticated Connector Exposure Detection
Identifies Drupal sites with the elfinder library installed, which could be vulnerable to unrestricted file upload through the connector.php file.When this component is detected, the site may be vulnerable to remote code execution attacks via PHP file uploads.This template only detects the presen...
EUVD-2026-25073
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...
CVE-2026-41459 Xerte Online Toolkits Path Disclosure via /setup
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...
EUVD-2021-31483
Malicious code in bioql PyPI...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
The CVE-2021-44663 vulnerability affects Xerte Project (Xerte) up to version 3.8.4, where remote code execution can be triggered via a crafted PHP file uploaded through elfinder in connector.php. The underlying issue enables network-exposed RCE with high impact (as indicated by CVSS scores in the...
CVE-2020-24246: Undefined Security Weakness
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files /filemanager/php/connector.php from Web Admin...
PT-2020-15672
Name of the Vulnerable Software and Affected Versions Peplink Balance versions prior to 8.1.0rc1 Description The issue allows an unauthenticated attacker to download PHP configuration files from the Web Admin interface. Specifically, the attacker can access the /filemanager/php/connector.php...
CVE-2019-1010178
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
CVE-2019-1010178
CVE-2019-1010178 affects MODX Revolution ≤ 1.0.0-beta4/β5 via the Fred add-on (assets/components/fred/web/elfinder/connector.php). The root cause is Incorrect Access Control (CWE-648), enabling Remote Code Execution. The attack vector involves uploading a PHP file or altering data in the database...
PT-2019-11497
Name of the Vulnerable Software and Affected Versions: Fred MODX Revolution versions prior to 1.0.0-beta5 Description: The issue is related to incorrect access control, allowing remote code execution. This can be achieved by uploading a PHP file or modifying data in the database. The vulnerable...
CVE-2019-1010178: Incorrect Use of Privileged APIs
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
PT-2019-11472
Name of the Vulnerable Software and Affected Versions: MODX Revolution Gallery version 1.7.0 Description: The issue allows creating a file with custom filename and content. It involves filtering user parameters before passing them into the phpthumb class. The attack vector is a web request via th...
CVE-2019-1010123: Unrestricted Upload of File with Dangerous Type
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
WordPress CYSTEME Finder Plugin 1.3 - Arbitrary File Upload
Arbitrary File Upload vulnerability was found in WordPress CYSTEME Finder Plugin 1.3. It allows remote attackers to upload aribitary files to the target server. This vulnerability exists in http://targetserver/wp-content/plugins/cysteme-finder/php/connector.php file. Solution Update CYSTEME Finde...
DoceboLMS <= 2.0.4 connector.php Shell Upload Exploit
No description provided by source. ?php ---docebo204xpl.php 15.38 04/12/2005 DoceboLMS AKA SpaghettiLearning= 2.0.4 connector.php Shell Upload coded by rgod site: http://rgod.altervista.org usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: This is called, using the conquered...