PT-2018-5198

Name of the Vulnerable Software and Affected Versions b2evolution versions 6.6.0 through 6.8.10 Description The issue concerns input validation in the basic install functionality of the software. Specifically, it involves the escape of backslash and single quote characters, which can be exploited...

CVE-2017-1000453: Improper Neutralization of Special Elements in Output Used by a Downstream Component

CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution...

CVE-2017-1000423: Improper Input Validation

b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...

CVE-2018-3814

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

CVE-2018-3814

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

CVE-2018-3814: Unrestricted Upload of File with Dangerous Type

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

CVE-2017-16949: Unrestricted Upload of File with Dangerous Type

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

CVE-2017-16949

Summary: CVE-2017-16949 affects the AccessKeys AccessPress Anonymous Post Pro WordPress plugin (versions up to 3.1.9). Improper input sanitization in the file-upload components (inc/cores/file-uploader.php and file-uploader/file-uploader-class.php) allows an unauthenticated attacker to override a...

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

Design/Logic Flaw

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

CVE-2017-17727

CVE-2017-17727 affects DedeCMS 5.6 and earlier. Affected component: template handling in member/article_edit.php; root cause: insufficient validation in the templet parameter allows embedding PHP code within a .jpg file, enabling arbitrary file upload and PHP code execution. Documented impact: re...

PT-2017-14652

Name of the Vulnerable Software and Affected Versions AccessKeys AccessPress Anonymous Post Pro plugin versions through 3.1.9 Description The issue is related to improper input sanitization, allowing an attacker to override settings for allowed file extensions and upload file size. This is due to...

CVE-2017-17727: Unrestricted Upload of File with Dangerous Type

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

PT-2017-14971

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7 Description The issue allows for arbitrary file upload and PHP code execution. This can be achieved by embedding PHP code in a .jpg file and using it in the templet parameter to the "member/article edit.php"...

PT-2017-14947

Name of the Vulnerable Software and Affected Versions vBulletin versions prior to 5.4 Description The issue allows remote PHP code execution due to an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. Specifically, while ../ traversal is...