CVE-2014-7986: Undefined Security Weakness

install/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application via a 1 value in the installProcess parameter...

CVE-2014-7985: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter to install/index.php...

CVE-2014-7987: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php...

PT-2014-8358

Name of the Vulnerable Software and Affected Versions EsppoCRM versions prior to 2.6.0 Description The issue allows remote attackers to re-install the application. This can be achieved by setting the installProcess parameter to 1 in the install/index.php file. Recommendations For versions prior t...

ThinkSAAS 2.2 GET型CSRF到Getshell

简要描述： 后台Getshell本想在XSS漏洞里一起提交的。。。结果我给忘了。 不过后来发现这个洞是Get型的CSRF，利用方便，老少咸宜，在社区CMS中可以说威力无限呀。 详细说明： /app/system/action/plugin.php 83行： case "delete": $apps = $GET'apps'; $pname = $GET'pname'; delDir'plugins/'.$apps.'/'.$pname; qiMsg'删除成功！'; break; 获得了GET到的值以后拼接成路径以后传入delDir函数。delDir函数： / 删除文件夹和文件夹下所有的文...

CVE-2014-5106

The CVE-2014-5106 entry describes a cross-site scripting (XSS) vulnerability in Invision Power IP.Board (IPB) 3.4.x through 3.4.6. An attacker could inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. This applies to IPB 3.4.x–3.4.6; no exploitation details...

CVE-2014-5106: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php...

PT-2014-6283

Name of the Vulnerable Software and Affected Versions Invision Power IP.Board versions 3.4.x through 3.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to the...

CVE-2013-5588: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the step parameter to install/index.php or 2 the id parameter to cacti/host.php...

PT-2013-5659

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8b and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. For example, the...

Kleeja Upload Center Script CRLF Injection

Exploit Title : Kleeja Upload Center Script CRLF injection Author:Ashiyane Digital Security Team home: http://ashiyane.org/forums version:1.0.1 software link: www.Kleeja.com Date:Sunday - 2012 25 November Google Dork: intext:Kleeja © 2007-2012. All rights reserved Type: CRLF injection Tested...

CVE-2012-5385: Undefined Security Weakness

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

PT-2012-5967

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5 Description The issue allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference in the install/index.php file. Recommendations For...

PT-2012-3240

Name of the Vulnerable Software and Affected Versions Zen Cart versions 1.5.0 and earlier Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the db username parameter to "zc install/index.php". This occurs when the software is...

WebCalendar 1.2.4 - Remote Code Execution

?php / ----------------------------------------------------------------------- WebCalendar = 1.2.4 install/index.php Remote Code Executionn Exploit ----------------------------------------------------------------------- author..........: Egidio Romano aka EgiX mail............:...

CVE-2008-6597: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1371: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-0612: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2007-2311: Undefined Security Weakness

PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the contentphp parameter. NOTE: this issue has been disputed by a reliable third party, stating that contentphp is initialized before use...

CVE-2007-1148: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter...