443 matches found
CVE-2019-12204
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
PT-2019-12695
Name of the Vulnerable Software and Affected Versions SilverStripe versions prior to 4.4 Description The issue arises from a missing warning about leaving install.php in a public webroot, which can lead to unauthenticated admin access. Recommendations For SilverStripe versions prior to 4.4, remov...
CVE-2019-12204: Undefined Security Weakness
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
CVE-2019-12204: Missing warning on install.php on public webroot can lead to unauthenticated admin access
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12204/...
CVE-2019-16314
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2...
CVE-2019-16314
Indexhibit 2.1.5 is vulnerable to remote code execution via the installer, exposed through /ndxzstudio/install.php?p=2. The vulnerability is documented in multiple sources (NVD, CNVD, Red Hat) with the same description, indicating that a product reinstallation can be abused to execute code remote...
CVE-2019-16314: Undefined Security Weakness
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2...
PT-2019-14623
Name of the Vulnerable Software and Affected Versions Indexhibit version 2.1.5 Description The issue allows for a product reinstallation, which can result in remote code execution. This can be achieved via the "/ndxzstudio/install.php?p=2" API endpoint. Recommendations For Indexhibit version 2.1....
osTicket 1.12 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category:...
Cross site scripting
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...
CVE-2019-14750
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...
CVE-2019-14746
A issue was discovered in KuaiFanCMS 5.0. It allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
Design/Logic Flaw
A issue was discovered in KuaiFanCMS 5.0. It allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
CVE-2019-14746: Improper Control of Generation of Code
A issue was discovered in KuaiFanCMS 5.0. It allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
CVE-2019-14750: Improper Neutralization of Input During Web Page Generation
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...
CVE-2013-7466
Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...
CVE-2013-7466
CVE-2013-7466 affects Simple Machines Forum (SMF) 2.0.4. The issue is a local file inclusion vulnerability in install.php that can execute remote code via an ../ directory traversal in the db_type parameter if install.php remains after installation. This is documented to enable remote code execut...
PT-2019-7015
Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows for local file inclusion, which can result in remote code execution. This is achieved through directory traversal in the db type parameter of the install.php file. The...
CVE-2013-7466: Improper Limitation of a Pathname to a Restricted Directory
Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...