CVE-2018-17030

BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php...

CVE-2018-17030: Improper Control of Generation of Code

BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php...

PT-2018-13848

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.2.23 Description The issue allows remote authenticated users with privileges to set hooks to execute arbitrary code. This is achieved via the "/core/admin/auto-modules/forms/process.php" API endpoint. Recommendations For...

CVE-2017-11736

SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array parameter...

CVE-2017-11736

SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array parameter...

CVE-2011-3776

phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php...

Information disclosure

phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php...

CVE-2011-3776: Exposure of Sensitive Information to an Unauthorized Actor

phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php...

PT-2011-4666

Name of the Vulnerable Software and Affected Versions phpFormGenerator version 2.09 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by accessing the 'forms/process.php' endpoint, which reveals the installation...