PT-2012-5892

Name of the Vulnerable Software and Affected Versions SAPID CMS version 1.2.3 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the root path parameter to specific API endpoints, such as "usr/extensions/get tree.inc.php" or...

CVE-2012-5293: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSrootpath parameter to usr/extensions/gettree.inc.php or 2 rootpath parameter to usr/extensions/getinfochannel.inc.php...

PT-2012-5843

Name of the Vulnerable Software and Affected Versions miniCMS versions 1.0 through 2.0 Description The issue allows remote attackers to execute arbitrary PHP code via crafted pagename or area variables containing executable extensions. This is due to improper handling by update.php when writing...

php execution vulnerability parsing-vulnerability warning-the black bar safety net

A code to perform the function In PHP you can execute the Code of the function. Such as eval , assert , the“and system and exec and shellexec and passthru and escapeshellcmd and pcntlexec , etc. demo code 1.1: ? php echo dir; ?& gt; The second file contains the code injection The file containing...

CVE-2012-1625: Improper Control of Generation of Code

Eval injection vulnerability in the fillpdfformexportdecode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors...

CVE-2012-3572

The CVE-2012-3572 entry concerns OSCC MyMeeting 3.0.1 and earlier, and MyMesyuarat 09b-1, where uploaded documents are not properly verified. This allows remote authenticated users to execute arbitrary PHP code via a crafted document, indicating a remote code execution vulnerability in the docume...

PT-2012-4819

Name of the Vulnerable Software and Affected Versions Open Source Competency Center OSCC MyMeeting versions 3.0.1 and earlier Open Source Competency Center OSCC MyMesyuarat version 09b-1 Description The issue allows remote authenticated users to execute arbitrary PHP code via a crafted document,...

CVE-2012-3527

TYPO3 upstream advisory CVE-2012-3527 affects TYPO3 4.5.x (before 4.5.19), 4.6.x (before 4.6.12) and 4.7.x (before 4.7.4). The vulnerability allows remote authenticated backend users to unserialize arbitrary objects and potentially execute PHP code via an unspecified parameter due to a missing si...

CVE-2011-4449

actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANETMODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a...

PT-2012-3781

Name of the Vulnerable Software and Affected Versions CKEditor module versions prior to 6.x-2.3 CKEditor module versions prior to 6.x-1.9 CKEditor module versions prior to 7.x-1.7 Description The issue allows remote authenticated users or remote attackers to execute arbitrary PHP code via the tex...

CVE-2011-4449: Undefined Security Weakness

actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANETMODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a...

CVE-2012-1641

The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...

PT-2012-3405

Name of the Vulnerable Software and Affected Versions Finder module versions 6.x-1.x before 6.x-1.26 Finder module versions 7.x-1.x Finder module versions 7.x-2.x before 7.x-2.0-alpha8 Description The issue allows remote authenticated users with the administer finder permission to execute arbitra...

CVE-2012-1641: Undefined Security Weakness

The finderimport function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import...

PT-2012-3664

Name of the Vulnerable Software and Affected Versions Newscoop versions 3.5.x through 3.5.4 Newscoop versions 4.0.0 through 4.0.RC3 Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This can be achieved by providing a URL in the GLOBALSg...

CVE-2010-5091

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

CVE-2010-5091: Improper Control of Generation of Code

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file...

PT-2012-5343

Name of the Vulnerable Software and Affected Versions Gallery 3 versions prior to 3.0.4 Description The issue allows attackers to execute arbitrary PHP code via unknown vectors. Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue...

CVE-2012-4343: Undefined Security Weakness

Multiple unspecified vulnerabilities in Gallery 3 before 3.0.4 allow attackers to execute arbitrary PHP code via unknown vectors...

CVE-2012-2073

The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors...