PT-2017-12167

Name of the Vulnerable Software and Affected Versions ZenCart version 1.5.5e Description The issue arises from the traverseStrictSanitize function in admin dir/includes/classes/AdminRequestSanitizer.php, which mishandles key strings. This allows remote authenticated users to execute arbitrary PHP...

PT-2017-12120

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns remote PHP code execution via the param parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection. Recommendations For FineCms version 5.0.9,...

CVE-2017-11585

CVE-2017-11585 affects dayrui FineCMS 5.0.9 with remote PHP code execution through the param parameter in an action=cache request to libraries/Template.php, described as Eval Injection. The vulnerability allows an attacker to inject and execute arbitrary PHP code on the server. Exploitation and e...

CVE-2017-11585: Improper Control of Generation of Code

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

CVE-2015-3638: Improper Control of Generation of Code

phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configurati...

PT-2017-6686

Name of the Vulnerable Software and Affected Versions phpMyBackupPro versions 2.5 and earlier Description The issue allows remote authenticated users to inject and execute arbitrary PHP scripts by exploiting the lack of proper escaping of the "." character in request parameters. This can be...

PT-2017-11791

Name of the Vulnerable Software and Affected Versions FineCMS version 2.1.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using a URL Manager "Add Site" action and entering the code after a ' sequence in a domain name. For example, using the...

CVE-2017-10968: Improper Control of Generation of Code

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...

PT-2017-11645

Name of the Vulnerable Software and Affected Versions FineCMS through 2017-07-07 Description The issue allows remote PHP code execution. This can be achieved by placing the code after "?php" in a route=template request, specifically in the application/core/controller/template.php file...

GShark Framework - Check all your backdoors with only one telegram account

This framework can perform web post exploitation, with this you can interact with multiple web backdoor and execute custom module, script. Check all your backdoors with only one telegram messenger account! Connect web backdoor to master server and control it with Telegram Download visual backdoor...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

PT-2017-19175

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.10.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via the database username, database host, or database password parameter in the install/save.php file. Recommendation...

CVE-2017-8402

PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file...

CVE-2017-8402: Improper Control of Generation of Code

PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file...

OV3 Online Administration 3.0 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications !-- OV3 Online Administration 3.0 Authenticated Code Execution Vendor: novaCapta Software & Consulting GmbH Product web page: http://www.meacon.de Affected version: 3.0 Summary: With the decision to use the OV3 as a platform for your data...

PT-2017-18323

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved through vectors involving the upload of a .htaccess file. Recommendations For PivotX version 2.3.11, consider...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution

This module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage' method allowi...

PT-2017-18691

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4 Description The issue allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. This is caused by a combination of Unrestricted File Upload and Code Injection in the sendfromfile.ph...

Nippon Institute of Agroinformatics SOY CMS Directory Traversal Vulnerability

Nippon Institute of Agroinformatics SOY CMS is a web content management system CMS from Nippon Institute of Agroinformatics, Japan. The system supports the creation of websites, the development of software based on A/B testing, and the optimization of websites. A directory traversal vulnerability...

MODX CMS 2.x < 2.5.7 Multiple Vulnerabilities

MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; if description...