CVE-2026-100698

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-100698: Server-Side Request Forgery (SSRF)

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-48247: Improper Certificate Validation

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPTSSLVERIFYPEER to false and not setting CURLOPTSSLVERIFYHOST when issuing outbound HTTPS requests for general-purpose outbound HTTPS requests issued by the shared helper functions. An...

CVE-2026-39971: Improper Neutralization of CRLF Sequences in HTTP Headers

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $SERVER'HTTPHOST' directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipityisResponseClean is not...

EUVD-2005-0889

Malware in sbrugna...

EUVD-2021-32130

Malicious code in bioql PyPI...

CVE-2021-45357

Cross Site Scripting XSS vulnerability exists in Piwigo 12.x via the pwgactivity function in include/functions.inc.php...

CVE-2021-45357

Cross Site Scripting XSS vulnerability exists in Piwigo 12.x via the pwgactivity function in include/functions.inc.php...

CVE-2021-45357

CVE-2021-45357 describes a cross-site scripting (XSS) vulnerability in Piwigo 12.x exploitable via the pwg_activity function in include/functions.inc.php. Public records in the connected sources confirm the vulnerable component and location, with related OpenVAS entry noting “Piwigo

FreePBX 13.0.35 remote code execution

A vulnerability overview 1. Vulnerability description FreePBX is called the Asterisk Management Portal, IP telephony tools Asterisk standardized implementation that provides a Web configuration interface and other workers FreePBX in functions.inc.php file exists for the parameters without...

FreePBX 'functions.inc.php' file remote code execution vulnerability

FreePBX is an Asterisk Dynamic IPPBX package developed using Linux, Apache, MySQL and PHP technologies. The functions.inc.php file in FreePBX has unfiltered parameters that are spliced directly into exec, which can be exploited to cause remote command execution...

FreePBX 13.0.35 - Remote Command Execution

FreePBX 13.0.35 - Remote Command Execution Vulnerable software : Freepbx Tested version : 13.0.35 vendor : freepbx.org Author : Ahmed sultan 0x4148 Email : [email protected] Summary : FreePBX is a web-based open source GUI graphical user interface that controls and manages Asterisk PBX, an open...

FreePBX 13.0.35 - Remote Command Execution

Vulnerable software : Freepbx Tested version : 13.0.35 vendor : freepbx.org Author : Ahmed sultan 0x4148 Email : [email protected] Summary : FreePBX is a web-based open source GUI graphical user interface that controls and manages Asterisk PBX, an open source communication server, With over 1...

FreePBX 13.0.35 Remote Code Execution

Vulnerable software : Freepbx Tested version : 13.0.35 vendor : freepbx.org Author : Ahmed sultan 0x4148 Email : [email protected] Summary : FreePBX is a web-based open source GUI graphical user interface that controls and manages Asterisk PBX, an open source communication server, With over 1...

Sql injection

SQL injection vulnerability in the genshowstatus function in functions.inc.php in Postfix Admin aka postfixadmin before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias...

CVE-2014-2655

CVE-2014-2655 : SQL injection in Postfix Admin (postfixadmin) via the gen_show_status function in functions.inc.php, exploitable before 2.3.7 when creating a new alias. Affected: Postfix Admin, prior to 2.3.7. Root cause: improper SQL handling in list-virtual.py? (per sources) and related advisor...

CVE-2014-2655

SQL injection vulnerability in the genshowstatus function in functions.inc.php in Postfix Admin aka postfixadmin before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias...

CVE-2014-2655: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the genshowstatus function in functions.inc.php in Postfix Admin aka postfixadmin before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias...

CVE-2008-3489

SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers to execute arbitrary SQL commands via a PXL cookie...

Directory traversal

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...