4055 matches found
CVE-2015-9499
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive...
Code injection
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive...
CVE-2015-9499
The Showbiz Pro plugin for WordPress (versions
CVE-2015-9499: Unrestricted Upload of File with Dangerous Type
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive...
WBCE CMS File Rename Filter Bypass Vulnerability
WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in the admin/media/rename.php file in WBCE CMS 1.4.0 and earlier versions. An attacker can exploit the vulnerability to rename media file names and extensions to execute arbitrary PHP...
PT-2019-15208
Name of the Vulnerable Software and Affected Versions WBCE CMS versions 1.4.0 and earlier Description A file-rename filter bypass issue exists in the admin/media/rename.php file. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension,...
CVE-2019-17370
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFiledeal.php blocks "into outfile" in a SELECT statement, but does not block the "into//outfile" manipulation. Therefore, the attacker can create a .php file...
PT-2019-15110
Name of the Vulnerable Software and Affected Versions OTCMS version 3.85 Description The issue allows for arbitrary PHP code execution. This is due to insufficient blocking of certain SQL manipulations in the admin/sysCheckFile deal.php file, specifically not blocking the "into//outfile"...
CVE-2019-17370: Improper Neutralization of Special Elements used in an SQL Command
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFiledeal.php blocks "into outfile" in a SELECT statement, but does not block the "into//outfile" manipulation. Therefore, the attacker can create a .php file...
SugarCRM Contacts Module SQL Injection Vulnerability
SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Contacts module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...
CVE-2019-15748: Unrestricted Upload of File with Dangerous Type
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...
CVE-2019-17188: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs...
CVE-2019-16722
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...
CVE-2019-16722
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...
Design/Logic Flaw
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...
CVE-2019-16722
CVE-2019-16722 affects ZZZCMS zzzphp v1.7.2. The vulnerability arises from an insufficient protection mechanism against PHP Code Execution, where a passthru call bypasses a str_ireplace operation. The connected documents consistently describe this flaw across sources (Red Hat, NVD, CVE registries...
CVE-2019-16722
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...
PT-2019-14794
Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.7.2 Description The issue is related to an insufficient protection mechanism against PHP code execution. Specifically, the passthru function bypasses an str ireplace operation, which is intended to prevent certain types...
CVE-2019-16722: Undefined Security Weakness
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...