Code injection

OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice...

CVE-2019-8408

OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice...

CVE-2019-8408

CVE-2019-8408 affects OneFileCMS 3.6.13. The vulnerability allows remote attackers to modify the file onefilecms.php by clicking the Copy button twice. The available sources document this behavior but do not provide concrete exploit details, affected versions beyond 3.6.13, or remediation steps. ...

CVE-2019-8408

OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice...

PT-2019-19016

Name of the Vulnerable Software and Affected Versions OneFileCMS version 3.6.13 Description The issue allows remote attackers to modify onefilecms.php by clicking the Copy button twice. Recommendations For OneFileCMS version 3.6.13, consider disabling the Copy button functionality in onefilecms.p...

OneFileCMS Information Disclosure Vulnerability

OneFileCMS is a lightweight CMS system. The system runs on PHP and JavaScript and includes features such as document editing, file uploading and file management. A security vulnerability exists in the onefilecms.php file in OneFileCMS 2017-10-08 and earlier versions. An attacker can exploit the...

PT-2018-11614

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2017-10-08 Description The issue allows attackers to delete arbitrary files via the Delete Files screen. This can be achieved by manipulating the URI, for example, by using a query string such as...

CVE-2018-13122: Incorrect Permission Assignment for Critical Resource

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...

CVE-2018-13123: Exposure of Sensitive Information to an Unauthorized Actor

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

OneFileCMS Brute Force Attack Vulnerability

OneFileCMS is a lightweight CMS system. The system runs on PHP and JavaScript and includes features such as document editing, file uploading and file management. A security vulnerability exists in the onefilecms.php file in OneFileCMS version 2012-04-14 and earlier. The vulnerability can be...

CVE-2018-12993

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecmsusername and onefilecmspassword fields...

CVE-2018-12995

OneFileCMS is affected by CVE-2018-12995 through its onefilecms.php file. The vulnerability enables arbitrary PHP code execution by submitting a .php filename on the Upload screen, affecting versions up to 2012-04-14. The root cause is improper handling of uploaded filenames, allowing execution o...

CVE-2018-12995: Improper Control of Generation of Code

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen...

CVE-2018-12993: Improper Restriction of Excessive Authentication Attempts

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecmsusername and onefilecmspassword fields...

CVE-2018-12994: Improper Control of Generation of Code

onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen...