CVE-2019-10863

A command injection vulnerability exists in TeemIp versions before 2.4.0. The newconfig parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server...

CVE-2023-48710

iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The pages/exec.php script as been...

CVE-2023-48710: Files or Directories Accessible to External Parties

iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The pages/exec.php script as been...

PT-2024-13628

Name of the Vulnerable Software and Affected Versions iTop versions prior to 2.7.10 iTop versions prior to 3.0.4 iTop versions prior to 3.1.1 iTop versions prior to 3.2.0 Description iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they...

CVE-2019-13967

iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service application outage via many requests to launch a compile operation. The requests use the pages/exec.php?execenv=production&execmodule=itop-hub-connector&execpage=ajax.php&operation=compile URI. This only affects the...

CVE-2019-13967: Undefined Security Weakness

iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service application outage via many requests to launch a compile operation. The requests use the pages/exec.php?execenv=production&execmodule=itop-hub-connector&execpage=ajax.php&operation=compile URI. This only affects the...

CVE-2019-18414

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...

Cross site request forgery (csrf)

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...

CVE-2019-18414

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...

CVE-2019-18414

CVE-2019-18414 affects Sourcecodester Restaurant Management System 1.0. The vulnerability is an admin/staff-exec.php Cross-Site Request Forgery due to missing CSRF protection, allowing an attacker to trick an administrator into performing unintended actions (e.g., executing arbitrary code or addi...

PT-2019-15397

Name of the Vulnerable Software and Affected Versions Sourcecodester Restaurant Management System version 1.0 Description The issue is related to a Cross Site Request Forgery vulnerability in the admin/staff-exec.php file due to a lack of CSRF protection. This could allow an attacker to trick the...

CVE-2019-18414: Cross-Site Request Forgery (CSRF)

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...

CVE-2019-11409

app/operatorpanel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when...

CVE-2019-11409: Improper Neutralization of Special Elements used in an OS Command

app/operatorpanel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when...

PT-2020-9419

Name of the Vulnerable Software and Affected Versions: iTop versions 2.2.0 through 2.6.0 Description: The issue allows remote attackers to cause a denial of service, resulting in an application outage. This is achieved by sending many requests to launch a compile operation, specifically targeting...

CVE-2019-10863

A command injection vulnerability exists in TeemIp versions before 2.4.0. The newconfig parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server...

CVE-2019-10863

A command injection vulnerability exists in TeemIp versions before 2.4.0. The newconfig parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server...

PT-2019-12061

Name of the Vulnerable Software and Affected Versions TeemIp versions prior to 2.4.0 Description A command injection issue exists, allowing malicious PHP code to be executed instantaneously through the new config parameter of the "exec.php" endpoint. This enables the creation of a new PHP file,...

CVE-2019-10863: Improper Control of Generation of Code

A command injection vulnerability exists in TeemIp versions before 2.4.0. The newconfig parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server...

CVE-2018-18320

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...