Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

The Drupal project uses the PEAR ArchiveTar library. The PEAR ArchiveTar library has released a security update that impacts Drupal. For more information please see: CVE-2020-28948 CVE-2020-28949 Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz...

CVE-2020-15247

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be...

PT-2020-4969

Name of the Vulnerable Software and Affected Versions Drupal Core versions prior to 9.0.8 Drupal Core versions prior to 8.9.9 Drupal Core versions prior to 8.8.11 Drupal Core versions prior to 7.74 Description The issue is related to the improper sanitization of certain filenames on uploaded file...

HorizontCMS File Upload Vulnerability

HorizontCMS is an open source, responsive content management system CMS built on Laravel 6, VueJs 2.6 and Bootstrap 3.4. HorizontCMS 1.0.0-beta is vulnerable to unrestricted file uploads. An attacker can exploit this vulnerability to upload PHP code via zip file and execute PHP files via HTTP GET...

CVE-2020-28693

An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/...

CMSuno Code Injection Vulnerability (CNVD-2020-63993)

CMSUno is an easy and handy tool for creating one-page responsive websites. A code injection vulnerability exists in CMSuno 1.6.2. This vulnerability can be exploited to inject malicious code into the "lang" parameter of /uno/central.php and run this PHP code in a web page to take over control of...

PT-2020-17032

Name of the Vulnerable Software and Affected Versions HorizontCMS version 1.0.0-beta Description The issue allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme. The attacker can then execute the PHP file via an HTTP GET request to /themes/...

CVE-2020-28693: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/...

CVE-2020-23138: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

CVE-2020-27387

An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload which will receiv...

PT-2020-16680 · Horizontcms · Horizontcms

Name of the Vulnerable Software and Affected Versions: HorizontCMS versions prior to 1.0.0-beta patched, but version number remains the same Description: The issue allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code. This is achieved by...

CVE-2020-27387: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload which will receiv...

CVE-2020-18185

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment...

CVE-2020-18185

Affected software : PluXml 5.7. Vulnerability component : class.plx.admin.php. Root cause / impact : Allows attackers to execute arbitrary PHP code by modifying the configuration file in a Linux environment, enabling code execution with the stated impact to confidentiality, integrity, and availab...

CVE-2020-18185

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment...

CVE-2020-18185

Removed by vendor...

PT-2020-15092

Name of the Vulnerable Software and Affected Versions PluxXml version 5.7 Description The theme edit function in PluxXml is affected by an issue that allows remote attackers to execute arbitrary PHP code. This can be achieved by placing the malicious code into a template, specifically through the...

PT-2020-15093

Name of the Vulnerable Software and Affected Versions PluXml version 5.7 Description The issue allows attackers to execute arbitrary PHP code by modifying the configuration file in a Linux environment, specifically through the class.plx.admin.php file. Recommendations For PluXml version 5.7, upda...

CVE-2020-18185: Improper Control of Generation of Code

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment...

CVE-2020-18184: Undefined Security Weakness

In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametresedittpl.php allows remote attackers to execute arbitrary PHP code by placing this code into a template...