CVE-2016-9493: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which m...

CVE-2016-9492: Unrestricted Upload of File with Dangerous Type

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PH...

Pragyan CMS 3.0 Remote File Inclusion Vulnerability

Exploit for php platform in category web applications =================================================== Pragyan CMS 3.0 Remote File Inclusion Vulnerability =================================================== In The Name Of GOD ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++...

Pragyan CMS 'form.lib.php'远程文件包含漏洞

BUGTRAQ ID: 30235 CNCAN ID：CNCAN-2008071602 Pragyan CMS是一款基于PHP的WEB应用程序。 Pragyan CMS不正确处理用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题由于'form.lib.php'脚本对用户提交给'sourceFolder'参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 Pragyan CMS 2.6.2 目前没有解决方案提供： http://sourceforge.net/projects/pragyan/...