4058 matches found
CVE-2018-16771
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
PT-2018-13735
Name of the Vulnerable Software and Affected Versions Hoosk version 1.7.0 Description The issue allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. Recommendations For Hoosk version 1.7.0, update to a newer version that contains a fix for thi...
PT-2018-13270
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...
CVE-2018-16771: Improper Control of Generation of Code
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
CVE-2018-15886: Improper Control of Generation of Code
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a...
CVE-2018-0658
Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...
CVE-2018-0645
MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors...
CVE-2018-0645
MTAppjQuery (Movable Type plugin) v1.8.1 and earlier is vulnerable to remote PHP code execution due to inclusion of Uploadify (unrestricted file upload, CWE-434). Exploitation could allow a remote attacker to execute arbitrary PHP code on the server. Affected: MTAppjQuery 1.8.1 and earlier. Root ...
PT-2018-8984
Name of the Vulnerable Software and Affected Versions MTAppjQuery versions 1.8.1 and earlier Description The issue allows remote PHP code execution via unspecified vectors. Recommendations For MTAppjQuery versions 1.8.1 and earlier, at the moment, there is no information about a newer version tha...
CVE-2018-0658: Improper Input Validation
Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...
PT-2018-8996
Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module 2.12 versions 3.5.23 and earlier EC-CUBE Payment Module 2.11 versions 2.3.17 and earlier GMO-PG Payment Module PG Multi-Payment Service 2.12 versions 3.5.23 and earlier GMO-PG Payment Module PG Multi-Payment Service 2.11...
CVE-2018-0645: Unrestricted Upload of File with Dangerous Type
MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors...
CVE-2018-16604
Nibbleblog v4.0.5 is affected. The issue allows an attacker with admin credentials to execute arbitrary PHP code by exploiting the username field, which is surrounded by double quotes (e.g., "${phpinfo()}"). Root cause is improper handling of the admin username leading to code execution. Impact i...
PT-2018-13643
Name of the Vulnerable Software and Affected Versions Nibbleblog version 4.0.5 Description An issue was discovered where an attacker can execute arbitrary PHP code by changing the username, as it is surrounded by double quotes, allowing for code injection, for example, $phpinfo. Recommendations F...
CVE-2018-16604: Improper Control of Generation of Code
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...
idreamsoft iCMS Path Traversal Vulnerability
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A path traversal vulnerability exists in admincp.php?app=config in idreamsoft iCMS version 7.0.11, which can be exploited by remote attackers to execute arbitrary PHP code in a ZIP file...
PT-2018-13524
Name of the Vulnerable Software and Affected Versions PESCMS Team version 2.2.1 Description The issue allows attackers to upload and execute arbitrary PHP code. This can be achieved by uploading a ZIP archive containing a .php file through the "/Public/?g=Team&m=Setting&a=upgrade" API endpoint...
CVE-2018-16370
In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...
CVE-2018-16370: Unrestricted Upload of File with Dangerous Type
In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...