CVE-2016-20100

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

CVE-2016-20100 Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

CVE-2016-20100 Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

EUVD-2016-10917

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

CVE-2016-20100

The Memphis Documents Library plugin for WordPress (versions before 3.1.6 ) is vulnerable to a path traversal vulnerability. This flaw allows unauthenticated attackers to read arbitrary files by sending GET requests containing traversal sequences to the mdocs_img_preview() function in mdocs-downl...

WordPress Memphis Documents Library path traversal vulnerability

WordPress Memphis Documents Library versions prior to 3.1.6 contain a path traversal vulnerability. This vulnerability stems from path traversal in the mdocs-img-preview parameter. Unauthenticated attackers can send GET requests containing a traversal sequence to mdocsimgpreview in...

PT-2026-118683

Name of the Vulnerable Software and Affected Versions Memphis Documents Library plugin for WordPress versions prior to 3.1.6 Description An issue allows unauthenticated attackers to read arbitrary files. This is achieved by sending GET requests containing traversal sequences to the mdocs img...

CVE-2016-20100: Improper Limitation of a Pathname to a Restricted Directory

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

VulnCheck KEV: CVE-2016-20100

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

CVE-2018-25248: Improper Neutralization of Input During Web Page Generation

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators...

PHPFusion < 9.03.60 RCE Vulnerability - Active Check

PHPFusion is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PHP-Fusion downloads.php Privilege Escalation (CVE-2020-24949)

A privilege escalation vulnerability exists in PHP-Fusion. The vulnerability is due to insufficient validation of HTTP request parameters in downloads.php...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

PT-2020-15866

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue allows an authenticated user to send a crafted request to the server, enabling them to perform remote command execution. This is a result of a privilege escalation flaw in the...

CVE-2020-24949: Undefined Security Weakness

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

Cross site scripting

Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the catid parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043...

CVE-2020-12708

Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the catid parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043...

CVE-2020-12708

PHP-Fusion 9.03.50 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the cat_id parameter to downloads/downloads.php or article.php. The issue is a result of insufficient input validation in these endpoints and is...

PT-2020-13220

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue allows remote attackers to inject arbitrary web script or HTML via the cat id parameter to "downloads/downloads.php" or "article.php", potentially leading to cross-site scripting attacks...