CVE-2026-54182

backpack/crud , a Laravel Backpack package for building admin panels, contains a pre-auth OS command injection in Stats::makeCurlRequest (src/Stats.php). The function builds a shell command from the HTTP Host header and passes it to exec() without adequate escaping. The path is reached from Backp...

CVE-2024-6937

A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curlexec of the file /admin/forms/optionlists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to...

PT-2024-33045

Name of the Vulnerable Software and Affected Versions mipjz version 5.0.5 Description An issue in the push method of apptagcontrollerApiAdminTag.php allows the postAddress parameter to be directly passed into curl exec execution and output without proper processing, resulting in a Server-side...

PT-2024-38272 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 7 Description: A critical issue has been found, affecting the curl exec function in the file /App/Core/Extend/Function/ydLib.php. The manipulation of the url argument leads to server-side request forgery. This issue can be...

PT-2024-37975 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: A problematic issue was found in the Import Option List component, specifically affecting the curl exec function in the /admin/forms/option lists/edit.php file. The manipulation of the url argument leads ...

PT-2018-13057

Name of the Vulnerable Software and Affected Versions Responsive FileManager versions prior to 9.13.3 Description The issue allows Directory Traversal and SSRF due to the direct use of the url parameter in a curl exec call. This can be exploited by providing a malicious value, such as...