CVE-2019-16114: Incorrect Authorization

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...

CVE-2006-4987: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Patrick Michaelis Wili-CMS allow remote attackers to execute arbitrary PHP code via a URL in the globalscontentdir parameter in 1 example-view/templates/article.php, 2 example-view/templates/root.php, and 3 example-view/templates/dateslist.php...