PT-2018-13270

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...

CVE-2018-16771: Improper Control of Generation of Code

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

CVE-2018-15886: Improper Control of Generation of Code

Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a...

CVE-2018-0658

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

CVE-2018-0645

MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors...

CVE-2018-0645

MTAppjQuery (Movable Type plugin) v1.8.1 and earlier is vulnerable to remote PHP code execution due to inclusion of Uploadify (unrestricted file upload, CWE-434). Exploitation could allow a remote attacker to execute arbitrary PHP code on the server. Affected: MTAppjQuery 1.8.1 and earlier. Root ...

CVE-2018-0645: Unrestricted Upload of File with Dangerous Type

MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors...

CVE-2018-0658: Improper Input Validation

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

PT-2018-8984

Name of the Vulnerable Software and Affected Versions MTAppjQuery versions 1.8.1 and earlier Description The issue allows remote PHP code execution via unspecified vectors. Recommendations For MTAppjQuery versions 1.8.1 and earlier, at the moment, there is no information about a newer version tha...

PT-2018-8996

Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module 2.12 versions 3.5.23 and earlier EC-CUBE Payment Module 2.11 versions 2.3.17 and earlier GMO-PG Payment Module PG Multi-Payment Service 2.12 versions 3.5.23 and earlier GMO-PG Payment Module PG Multi-Payment Service 2.11...

CVE-2018-16604

Nibbleblog v4.0.5 is affected. The issue allows an attacker with admin credentials to execute arbitrary PHP code by exploiting the username field, which is surrounded by double quotes (e.g., "${phpinfo()}"). Root cause is improper handling of the admin username leading to code execution. Impact i...

PT-2018-13643

Name of the Vulnerable Software and Affected Versions Nibbleblog version 4.0.5 Description An issue was discovered where an attacker can execute arbitrary PHP code by changing the username, as it is surrounded by double quotes, allowing for code injection, for example, $phpinfo. Recommendations F...

CVE-2018-16604: Improper Control of Generation of Code

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

idreamsoft iCMS Path Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A path traversal vulnerability exists in admincp.php?app=config in idreamsoft iCMS version 7.0.11, which can be exploited by remote attackers to execute arbitrary PHP code in a ZIP file...

PT-2018-13524

Name of the Vulnerable Software and Affected Versions PESCMS Team version 2.2.1 Description The issue allows attackers to upload and execute arbitrary PHP code. This can be achieved by uploading a ZIP archive containing a .php file through the "/Public/?g=Team&m=Setting&a=upgrade" API endpoint...

CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16370: Unrestricted Upload of File with Dangerous Type

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

PT-2018-13486

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.11 Description The issue allows for Directory Traversal, resulting in the execution of arbitrary PHP code from a ZIP file. This can be achieved through the admincp.php application, specifically by accessing the...