280 matches found
wordpress_DoS
WordPress 4.9.8 is vulnerable to DoS Attacks. Additional Information We found a Denial of Service DoS in WordPress version 4.9.8. An unauthenticated remote user can perform a series of requests on the vulnerable pages, resulting in increased processing, swap and disk I/O on the server. This...
opendcim-exploit
openDCIM - 구성 오염을 통한 SQLi에서 RCE까지 openDCIM의 install.php LDAP 구성 폼을 대상으로 한 원격 코드 실행 체인입니다. VulnCheck go-exploit 프레임워크를 기반으로 구축되었습니다. 취약점 체인...
WBCE-v1.6.3-Authenticated-RCE
WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; 모듈이 "유효한 애드온"으로 이 검사를 통과하면, 서버에서 install.php 스크립트가 자동으로 실행됩니다. 이 익스플로잇은 단순히 PHP 페이로드로 PHP 리버스 셸을 사용합니다. YouTube 데모: https://youtu.be/Dhg5gRe9Dzs?si=LHC29PBRRRPNNy73 root@kitploit: Description: This is an Authenticated RCE exploit for WBCE CMS...
CVE-2025-61505
CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...
CVE-2018-19180
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...
CVE-2019-12204
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
CVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...
CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...
EUVD-2025-33763
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
e107 安全漏洞
e107 is an open source, free and PHP and MySQL based content management system CMS by the E107 team. The system supports a wide range of plug-ins and look-alike themes, and can be used as a personal blog, discussion community, archive repository, and so on. A security vulnerability exists in e107...
CVE-2025-61505
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
CVE-2025-61505
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the install.php script. The script processes user-controlled input in the previoussteps POST parameter using unserializebase64decode without validation, allowing attackers to craft malicious serialized data. This could lead to remo...
EUVD-2005-0801
Malware in sbrugna...
EUVD-2019-17251
Malware in sbrugna...
EUVD-2018-10603
Malware in sbrugna...