CVE-2019-19511

CVE-2019-19511 Chevereto - 1.0.0 Free - 1.1.4 Free, = 3.13.4 Core, Remote Code Execution Description installer.php in Chevereto through 1.1.4 Free, and through 3.13.4 Core, allows remote authenticated admins to execute arbitrary PHP code by injecting this code into the setup process and overwriti...

CVE-2026-30461

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the /controllers/Installer.php and the function addgitsubmodule...

CVE-2026-30461

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the /controllers/Installer.php and the function addgitsubmodule...

CVE-2026-30461: Improper Neutralization of Special Elements used in a Command

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the /controllers/Installer.php and the function addgitsubmodule...

CVE-2026-30461

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the /controllers/Installer.php and the function addgitsubmodule...

EUVD-2026-18216

A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

OpenCart 路径遍历漏洞

OpenCart is an open-source e-commerce system developed by the OpenCart team in China. This system provides modules for product reviews, product ratings, and product addition. Version 4.1.0.3 of OpenCart has a path traversal vulnerability; this vulnerability stems from the installer.php file in th...

CVE-2026-5331: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

PT-2026-29734

A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

EUVD-2017-7990

Malware in sbrugna...

CVE-2020-10568

The sitepress-multilingual-cms WPML plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings...

CVE-2020-10568: Cross-Site Request Forgery (CSRF)

The sitepress-multilingual-cms WPML plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings...

PT-2020-12209

Name of the Vulnerable Software and Affected Versions sitepress-multilingual-cms WPML plugin versions prior to 4.3.7-b.2 Description The issue is due to a loose comparison, leading to CSRF, which can result in remote code execution in includes/class-wp-installer.php via a series of requests that...

CVE-2018-17207: Improper Control of Generation of Code

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

PT-2018-10327

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue concerns a SQL injection vulnerability, specifically a blind time-based type, in the Quest KACE System Management Appliance. This occurs due to the lack of sanitizati...

Design/Logic Flaw

installer.php in the Snap Creek Duplicator WordPress Site Migration & Backup plugin before 1.2.30 for WordPress has XSS because the values "urlnew" /wp-content/plugins/duplicator/installer/build/view.step4.php and "logging" wp-content/plugins/duplicator/installer/build/view.step2.php are not...

CVE-2017-16815

installer.php in the Snap Creek Duplicator WordPress Site Migration & Backup plugin before 1.2.30 for WordPress has XSS because the values "urlnew" /wp-content/plugins/duplicator/installer/build/view.step4.php and "logging" wp-content/plugins/duplicator/installer/build/view.step2.php are not...

PT-2017-14578

Name of the Vulnerable Software and Affected Versions Duplicator WordPress Site Migration & Backup plugin versions prior to 1.2.30 Description The issue arises from insufficient filtering of the url new and logging values in the installer.php file. This can lead to XSS attacks. The url new value ...

CVE-2017-16815: Improper Neutralization of Input During Web Page Generation

installer.php in the Snap Creek Duplicator WordPress Site Migration & Backup plugin before 1.2.30 for WordPress has XSS because the values "urlnew" /wp-content/plugins/duplicator/installer/build/view.step4.php and "logging" wp-content/plugins/duplicator/installer/build/view.step2.php are not...