9874 matches found
PT-2018-18878
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The issue concerns a CSRF vulnerability in the file manage control.php file. This vulnerability can be exploited by renaming an arbitrary file under uploads/userup to a .php file under the web root, allowing for...
Code injection
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
CVE-2018-8823
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
TestLink Open Source Test Management Code Execution
Title: TestLink Open Source Test Management comment out skip-networking as well as bind-address if any present in my.cnf i.e chang...
TestLink Open Source Test Management < 1.9.16 - Remote Code Execution Exploit
Exploit for linux platform in category remote exploits Title: TestLink Open Source Test Management comment out skip-networking as well as bind-add...
PT-2018-18645
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module version 1.0.32 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the code parameter in the...
Cross site request forgery (csrf)
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 (including 5.7SP2) is vulnerable to CSRF that can lead to arbitrary code execution via the partcode parameter in tag_test_action.php (runphp field with PHP code). Exploitation appears in the wild (2025), and remediation is to apply security patches/update to a newer DedeCMS version. A...
TestLink Open Source Test Management < 1.9.16 - Remote Code Execution (PoC)
TestLink Open Source Test Management 1.9.16 - Remote Code Execution PoC. CVE-2018-7466. Remote exploit for Linux platform Title: TestLink Open Source Test Management= 1.9.16 Remote Code Execution By Manish error1046 Vendor Home Page: http://testlink.org Disovered At: Indishell Lab CVE ID:...
TestLink Open Source Test Management 1.9.16 - Remote Code Execution (PoC)
TestLink Open Source Test Management 1.9.16 - Remote Code Execution PoC Title: TestLink Open Source Test Management comment out skip-networking as well as bind-address if any presen...
Creditwest Bank CMS Project Cross-Site Request Forgery Vulnerability
The Creditwest Bank CMS Project aka CWCMS is a content management system CMS. A cross-site request forgery vulnerability exists in the Website Configuration Update feature in Creditwest Bank CMS Project 2017-07-28 and prior releases. A remote attacker can exploit this vulnerability to inject...
CVE-2014-2293
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the 1 authenticationmethodser or 2 authenticationinfoser parameter to index.php, or 3...
ZZCMS 'siteurl' parameter PHP code injection vulnerability
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited to inject PHP code by sending 'siteurl' parameter to install/index.php file...
PT-2018-4194
Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11 Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code...
Cross site request forgery (csrf)
Creditwest Bank CMS Project aka CWCMS through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters...
CVE-2018-8972
Creditwest Bank CMS Project aka CWCMS through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters...
CVE-2018-8972
Creditwest Bank CMS Project aka CWCMS through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters...
CVE-2018-8972
Creditwest Bank CMS Project (CWCMS) prior to 2017-07-28 contains a cross-site request forgery (CSRF) vulnerability in the Website Configuration Update feature. This CSRF flaw enables an attacker to inject arbitrary PHP code, demonstrated by a PHP shell that calls eval on request parameters. Affec...
Code injection
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...