445 matches found
PT-2018-9880
Name of the Vulnerable Software and Affected Versions: Cosmo version 1.0.0Beta6 Description: The issue allows attackers to execute arbitrary PHP code via the Database Prefix field on the "Database Info" screen of "install.php". Recommendations: For Cosmo version 1.0.0Beta6, avoid using the Databa...
PT-2018-18077
Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.1.6 Description A remote code execution issue exists, allowing attackers to inject arbitrary PHP code via the timezone parameter in step 4 of a fresh installation procedure, specifically in the...
CVE-2018-7448: Improper Neutralization of Special Elements used in an OS Command
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure...
CVE-2018-7271: Improper Control of Generation of Code
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...
CVE-2018-5749
install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the 1 databaseserver, 2...
PT-2018-17122
Name of the Vulnerable Software and Affected Versions: Minecraft Servers List Lite versions prior to commit c1cd164 Premium Minecraft Servers List versions prior to 2.0.4 Description: The issue is related to the install.php file, which does not properly sanitize input before saving database...
SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...
CVE-2017-16759
The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...
CVE-2017-16759
CVE-2017-16759 affects LibreNMS: the installation process before 2017-08-18 allows remote attackers to read arbitrary files via html/install.php. Multiple connected sources (GitHub security advisory GHSA-4CCX-WJQP-5FWW, OSV, CNVD/CNVD-2017-36362, NVD entry) corroborate an arbitrary file read duri...
CVE-2017-16759
The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...
CVE-2017-16759
The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...
PT-2017-14541
Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 2017-08-18 Description The issue allows remote attackers to read arbitrary files, related to html/install.php. Recommendations For versions prior to 2017-08-18, update to a version released after 2017-08-18 to resolv...
CVE-2017-16759: Improper Limitation of a Pathname to a Restricted Directory
The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...
Typecho blog install.php has command execution vulnerability
Typecho is an open source blogging platform written in PHP. A command execution vulnerability exists in Typecho blog install.php, which can be exploited by an attacker to cause remote code execution and gain administrative privileges...
CVE-2017-14050
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...
PT-2017-13224
Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file. This is possible through the backend/addons/install.php endpoint. Recommendations For...
CVE-2017-14050: Unrestricted Upload of File with Dangerous Type
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...
Question2Answer User Account Creation Vulnerability
Question2Answer is a PHP implementation of the class StackOverflow website question and answer system . A security vulnerability exists in the qa-include/qa-install.php file in Question2Answer versions prior to 1.7.5. A remote attacker can exploit this vulnerability to create multiple user accoun...