EUVD-2026-61020

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-45117: Improper Control of Generation of Code

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

DedeCMS Setup Code Execution

The vulnerability of the 4Setup function in the DedeCMS content management system’s install/index.php script is related to improper external manipulation of file names or file paths. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-19353

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting Detection

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL !/usr/bin/env python3 -- coding: utf-8 --...

AVideo Installer - Detect

AVideo installer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AVideo installer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AVideo Installer - Detect', 'description': 'AVide...

EyouCMS - Installation Detection

EyouCMS installation is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """EyouCMS installation is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EyouCMS - Installation Detection', 'description': 'EyouCM...

CVE-2026-13529: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of the argument siteurl can lead to sql injection. The attack can be executed remotely. A high complexity level is associated with this attack...

PT-2026-69294

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7.119 UTF8SP2 Description A file inclusion issue exists within the Installation Wizard component. The flaw is located in the 4 Setup function of the install/index.php file. This allows a remote attacker to include...

EUVD-2019-7936

Malware in sbrugna...

EUVD-2018-20573

Malware in sbrugna...

EUVD-2019-7934

Malware in sbrugna...

EUVD-2019-7935

Malware in sbrugna...

CVE-2025-25991: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component...

PT-2025-7119

Name of the Vulnerable Software and Affected Versions: hooskcms version 1.7.1 Description: The issue allows a remote attacker to obtain sensitive information. This is achieved via the "/install/index.php" component. Recommendations: For hooskcms version 1.7.1, update to a version that fixes this...

CVE-2025-25990

Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component...

CVE-2025-25991

The content management system hooskcms v.1.7.1 is susceptible to an SQL Injection vulnerability (CWE-89). A remote attacker can exploit the /install/index.php component to obtain sensitive information . While the vulnerability is confirmed, there is currently no information regarding a newer vers...

CVE-2025-25990: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component...

CVE-2025-25991

SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component...

CVE-2024-52702: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set ...