CVE-2020-18890: Improper Preservation of Permissions

Rmote Code Execution RCE vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php...

CVE-2020-18888: Missing Authorization

Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php...

PT-2021-11755

Name of the Vulnerable Software and Affected Versions: 74cms version 5.0.1 Description: The issue is a remote code execution vulnerability located in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php. This allows attackers to obtain server permissions and...

CVE-2020-35339: Improper Control of Generation of Code

In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server...

CVE-2020-28037: Improper Check for Unusual or Exceptional Conditions

isbloginstalled in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution as well as a denial of service for the old installation...

Sql injection

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

CVE-2020-27886

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

CVE-2020-27886: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

PT-2020-16825

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.3-7 through 5.3-8 Description The issue is related to a SQL injection in the eonweb web interface, allowing an unauthenticated attacker to exploit the username available function of the includes/functions.php...

CVE-2019-17230

The OneTone theme for WordPress (versions 3.0.6 and earlier ) contains a security vulnerability in the includes/theme-functions.php file. This flaw allows unauthenticated attackers to perform unauthorized options changes , which can be used to modify site content such as 404 page messages to inje...

CVE-2019-17230: Undefined Security Weakness

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...

CVE-2019-17231: Improper Neutralization of Input During Web Page Generation

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues...

PT-2020-9884

Name of the Vulnerable Software and Affected Versions OneTone theme versions 3.0.6 and earlier for WordPress Description The issue allows unauthenticated options changes due to a problem in the includes/theme-functions.php file. Recommendations For OneTone theme versions 3.0.6 and earlier, update...

PT-2020-9885

Name of the Vulnerable Software and Affected Versions OneTone theme versions 3.0.6 and earlier for WordPress Description The issue concerns multiple stored XSS problems. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world...

Code injection

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

PT-2020-7705

Name of the Vulnerable Software and Affected Versions Status2K Server Monitoring Software version 2.5 Description A vulnerability exists in the software via the multies parameter to "includes/functions.php", which could let a malicious user execute arbitrary PHP code. Recommendations For version...

CVE-2014-5091: Improper Input Validation

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

Backup and Staging by WP Time Capsule < 1.21.16 - Authentication Bypass

It is possible to login as an administrator on the site due to logical mistakes in the code. The issue resides in wptc-cron-functions.php line 12 where it parses the request. This parserequest function calls the function decodeserverrequestwptc which check if the raw POST payload contains a certa...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358: Deserialization of Untrusted Data

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...