4052 matches found
GeniXCMS arbitrary PHP code execution
In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...
GHSA-Q263-J3Q9-G964 October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-3GX6-H57H-RM27 Drupal Core Remote Code Execution Vulnerability
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...
Elefant CMS PHP Code Execution Vulnerability
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with ?php content, because of insufficient input validation in...
TYPO3 PHP remote file inclusion vulnerability
PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable...
GHSA-6766-R2RX-MFW9 MoinMoin Directory traversal vulnerability
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot in the MOINID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been...
MoinMoin Directory traversal vulnerability
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot in the MOINID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been...
Vulnerability of the __debugging_center_utils___.php component in NUUO NVRmini and NVRsolo network video recording systems, allowing intruders to execute arbitrary PHP code.
The vulnerability of the debuggingcenterutils.php component in NUUO NVRmini and NVRsolo network video recording systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary PHP code...
Privilege escalation
Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2021-43421
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code...
PT-2022-11833
Name of the Vulnerable Software and Affected Versions Studio-42 elFinder versions 2.0.4 through 2.1.59 Description A File Upload issue exists via the connector.minimal.php file, allowing a remote malicious user to upload arbitrary files and execute PHP code. Recommendations For versions 2.0.4...
CVE-2021-28428: Unrestricted Upload of File with Dangerous Type
File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...
CVE-2021-46433
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
Spoofing
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
CVE-2021-46433
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
CVE-2021-46433: Undefined Security Weakness
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
CVE-2022-24652
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload...