14 matches found
CVE-2026-15070: Cross-Site Request Forgery (CSRF)
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inje...
PT-2021-3961
Name of the Vulnerable Software and Affected Versions FUEL CMS versions 1.5.0 Description A host header attack issue exists due to the lack of special element neutralization in fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php. This can allow a remote attacker ...
Vanilla: Vanilla Forums ImportController index file_exists Unserialize Remote Code Execution Vulnerability
Summary: An authenticated admin user can inject an serialized payload into a phar archive and trigger read access to it via an unprotected fileexists. An attacker can leverage this to deserialize untrusted data and gain remote code execution. Notes: - You need to have an admin account to run this...
Vanilla: Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution Vulnerability
Summary: An authenticated admin user can inject an unserializable password in a another users account. Later when attempting a login with that user, the attacker can trigger a call to an unserialize in the splitHash function. By using a custom pop chain to write into the constants.php file, an...
JASmine <= 0.0.2 (index.php) Remote File Include Vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class JASmineNewsRemoteFileIncludePOCBase: vulID = '64073' version = '1' vulDate = '2006-10-17' author = ' '...
phpBB PlusXL <= 2.0_272 (constants.php) Remote File Include Exploit
No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class phpBBPlusXLRemoteFileIncludePOCBase: vulID = '64099' version = '1' vulDate = '2006-10-18' author = ' '...
CVE-2008-6960: Undefined Security Weakness
download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php...
CVE-2006-5387: Undefined Security Weakness
PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20272 and earlier phpBB module allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...
phpBB PlusXL <= 2.0_272 (constants.php) Remote File Include Exploit
No description provided by source. !/usr/bin/perl phpBB PlusXL 2.X biuld 272 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high...
CVE-2006-4424: Undefined Security Weakness
PHP remote file inclusion vulnerability in coinincludes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the CCFGPKGPATHINCL parameter...
PHPCOIN 1.2.3 - session_set.php Remote File Inclusion
PHPCOIN 1.2.3 - sessionset.php Remote File Inclusion phpCOIN 1.2.3 CCFGPKGPATHINCL Remote Include Vulnerability Discovered by: Timq http://www.securitydb.org Email: timqathackernetworkdotcom http://www.securitydb.org Vulnerable: requireonce include $CCFG'PKGPATHINCL'.'redirect.php'; Exploit PoC:...
CVE-2006-3793
CVE-2006-3793 affects SiteDepth CMS 3.01 and earlier. The vulnerability is a PHP remote file inclusion in constants.php triggered by a URL in the SD_DIR parameter, enabling an attacker to execute arbitrary PHP code. The NVD listing notes a CVSS v2 base score of 5.1 (Medium) with network attack ve...
CVE-2006-3793: Undefined Security Weakness
PHP remote file inclusion vulnerability in constants.php in SiteDepth CMS 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SDDIR parameter...
SiteDepth CMS 3.0.1 - 'SD_DIR' Remote File Inclusion
Title: SiteDepth CMS = 3.0.1 - Remote File Include Vulnerability ------------------------------------------------------------------ Vendor: SiteDepth.com URL: http://sitedepth.com ------------------------------------------------------------------ Credits: Discovered by: "Aesthetico"...