445 matches found
CVE-2013-7466: Improper Limitation of a Pathname to a Restricted Directory
Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
Design/Logic Flaw
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2019-7720
taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
CVE-2019-7720
taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
PT-2019-18721
Name of the Vulnerable Software and Affected Versions Nibbleblog version 4.0.5 Description The issue allows for eval injection by placing PHP code in the username parameter of the install.php file, and then making a request to the "content/private/shadow.php" endpoint. Recommendations For...
TaoCMS code injection vulnerability
TaoCMS is a php sqlite/mysql based ultra-small CMS management system. TaoCMS is vulnerable to code injection, which can be exploited by placing PHP code in the install.php dbname parameter and then issuing a config.php request to perform eval injection...
CVE-2019-7719: Improper Control of Generation of Code
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
PT-2019-18722
Name of the Vulnerable Software and Affected Versions taocms versions prior to 2014-05-24 Description The issue allows for eval injection by placing PHP code in the db name parameter of install.php and then making a request to config.php. Recommendations For versions prior to 2014-05-24, avoid...
CVE-2019-7720: Improper Control of Generation of Code
taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php dbname parameter and then making a config.php request...
CVE-2019-7692: Improper Control of Generation of Code
install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder...
Path traversal
Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...
CVE-2018-20614
public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...
CVE-2018-20614
CVE-2018-20614 affects CIM 0.9.3; publicly reachable endpoint public/install/#/step3 enables remote reload of the product via public/install/. Root cause: web path handling in public/install allows unauthenticated access to trigger a reload action. Impact is defined as remote reload capability, w...
PT-2018-15466
Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for full path disclosure via the "/install.php?s=/1" API endpoint. This could potentially reveal sensitive information about the system's directory structure. Recommendations...