Online Traffic Offense Management System 1.0 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.sourcecodester.com Software Link:...

PT-2021-22674

Name of the Vulnerable Software and Affected Versions: FlatCore-CMS version 2.0.7 Description: A Remote Code Execution RCE issue exists via the upload addon plugin, allowing a remote malicious user to execute arbitrary PHP code. Recommendations: For FlatCore-CMS version 2.0.7, consider disabling...

PT-2021-10114

Name of the Vulnerable Software and Affected Versions: Twothink version 2.0 Description: A remote code execution issue in the /library/think/App.php file of Twothink allows attackers to execute arbitrary PHP code. Recommendations: For Twothink version 2.0, at the moment, there is no information...

CVE-2021-21804

A local file inclusion LFI vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability...

CVE-2021-21804

Advantech R-SeeNet v2.4.12 contains a local file inclusion (LFI) in options.php where unsanitized user input ($sub_opt) is passed to include, enabling arbitrary PHP code execution. The TALOS writeup confirms an exploitable path via crafted HTTP requests (example uses php://filter to read config.i...

Advantech R-SeeNet File Inclusion Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

CVE-2021-21804: Improper Control of Filename for Include/Require Statement in PHP Program

A local file inclusion LFI vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability...

Advantech R-SeeNet options.php local file inclusion (LFI) vulnerability

Summary A local file inclusion LFI vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability. Tested...

Advantech R-SeeNet 安全漏洞

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

Advisory ROSA-SA-2021-1809

Software: bolt 0.7 OS: Cobalt 7.9 CVE-ID: CVE-2015-7309 CVE-Crit: HIGH CVE-DESC: The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, allowing remote authenticated users to execute arbitrary code by renaming a created file and then directly accessing it...

TOCTOU Race Condition enabling remote code execution

Impact The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions: - A user is allowed to supply the path or filename of an uploaded file. - The supplied...

CVE-2013-20002

Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework before 1.2.2 wp-content/themes/elemin/themify/themify-ajax.php file...

CVE-2021-34128

LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname...

PT-2021-3361

Name of the Vulnerable Software and Affected Versions LaikeTui version 3.5.0 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a ZIP archive containing a .php file. This can be achieved by using the "index.php?module=system&action=pay" endpoint to...

Unrestricted File Upload

studio-42/elfinder allows unrestricted file uploads. An attacker is able to upload PHP code in a .phar file and obtain arbitrary code execution on the host OS...

CVE-2021-23394

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394: Unrestricted Upload of File with Dangerous Type

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

Invision Community Code Injection Vulnerability

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. in the United States. A code injection vulnerability exists in versions prior to Invision Community 4.6.0, which can be exploited by attackers to inject and execute arbitrary PHP code...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

PT-2021-3652

Name of the Vulnerable Software and Affected Versions QibosoftX1 version 1.0 Description A code injection issue has been found in the Upgrade function, related to incorrect code generation management in components such as client upgrade edition.php and Upgrade.php. This allows an attacker to...