Remote code execution

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...

PT-2019-14518

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4 Description The issue allows an unauthenticated attacker to modify application settings, forcing the application to use a crafted database. This enables the attacker to gain access to the application. Furthermore, the...

CVE-2018-10082: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...

PT-2018-9667

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue allows physical path leakage through various means, including an invalid page value in the /index.php?page= parameter, a crafted URI starting with /index.php?mact=Search, or...

CVE-2017-14247

SQL Injection exists in the EyesOfNetwork web interface aka eonweb 5.1-0 via the userid cookie to header.php, a related issue to CVE-2017-1000060...

Sql injection

SQL Injection exists in the EyesOfNetwork web interface aka eonweb 5.1-0 via the userid cookie to header.php, a related issue to CVE-2017-1000060...

CVE-2017-14247

SQL Injection exists in the EyesOfNetwork web interface aka eonweb 5.1-0 via the userid cookie to header.php, a related issue to CVE-2017-1000060...

PT-2017-13321

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description A SQL Injection issue exists in the EyesOfNetwork web interface, allowing exploitation via the user id cookie in the header.php file. Recommendations For version 5.1-0, consider restricting access to the...

CVE-2017-14247: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the EyesOfNetwork web interface aka eonweb 5.1-0 via the userid cookie to header.php, a related issue to CVE-2017-1000060...

PT-2017-17970

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.18 Description The issue allows remote attackers to bypass CSRF protection by manipulating the HTTP Referer header. This is due to the reliance on a substring check for CSRF protection, which can be exploited ...

CVE-2016-5739

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

CVE-2016-5739

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

CVE-2016-5739: Exposure of Sensitive Information to an Unauthorized Actor

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

Mao10CMS Theme\default\Public\header.php id parameter SQL injection

No description provided by source...

WordPress Header.php Unauthorized Code Injection

A Code Injection vulnerability has been reported in WordPress. Successful exploitation of this vulnerability would allow a remote attacker to redirect the clients who access an Infected WordPress website to an attacker-controlled page, and infect the client host...

CMSEASY 5.5 /celive/live/header.php SQL注入漏洞

No description provided by source...

CVE-2014-9400

CVE-2014-9400 concerns the WordPress plugin “WP Unique Article Header Image” (version 1.0 and earlier). The connected sources confirm CSRF vulnerabilities that allow an attacker to hijack an administrator’s authentication for requests leading to cross-site scripting (XSS) via the parameters gt_de...

PT-2014-8991

Name of the Vulnerable Software and Affected Versions Wp Unique Article Header Image plugin version 1.0 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the gt...

CMSEasy 5.5 /celive/live/header.php SQL注入漏洞

No description provided by source...

phpbms 0.96 Multiple Vulnerabilities

No description provided by source. phpBMS v0.96 phpbms.org eLwauxc2009, uasc.org.ua http://phpbms.org/trial/ SQL Inj -------------------------------------------------------------------------------------------------------------------------------------------------------------------------...