CVE-2018-16974

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

CVE-2018-16974

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

CVE-2018-16975

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with ?php content, because of insufficient input validation in...

CVE-2018-16974

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

CVE-2018-16975

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with ?php content, because of insufficient input validation in...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

PT-2018-13806

Name of the Vulnerable Software and Affected Versions Elefant CMS versions prior to 2.0.7 Description The issue concerns a PHP Code Execution Vulnerability. It can be exploited by using the /filemanager/api/rm/.htaccess endpoint to remove the .htaccess file, and then using a filename that ends in...

PT-2018-13807

Name of the Vulnerable Software and Affected Versions Elefant CMS versions prior to 2.0.7 Description The issue is related to a PHP Code Execution Vulnerability. It can be exploited through the /designer/add/stylesheet.php endpoint by using a .php extension in the New Stylesheet Name field in...

PT-2018-13539

Name of the Vulnerable Software and Affected Versions e107 version 2.1.8 Description The issue allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the content type set to 'image/jpeg'. This is possible due to a flaw in the 'e107 web/js/plupload/upload.php' file...

CVE-2018-16388: Unrestricted Upload of File with Dangerous Type

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16974: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

CVE-2018-16975: Improper Control of Generation of Code

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with...

CVE-2018-15886

Monstra CMS 3.0.4 is affected by a PHP code execution vulnerability via modified Snippet content, enabling arbitrary PHP code execution (e.g., via selecting admin/snippets edit and appending code after a

CVE-2018-16771

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

CVE-2018-16771

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

Sql injection

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

CVE-2018-16771

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

PT-2018-13735

Name of the Vulnerable Software and Affected Versions Hoosk version 1.7.0 Description The issue allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. Recommendations For Hoosk version 1.7.0, update to a newer version that contains a fix for thi...