CVE-2017-11167

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

PT-2017-11791

Name of the Vulnerable Software and Affected Versions FineCMS version 2.1.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using a URL Manager "Add Site" action and entering the code after a ' sequence in a domain name. For example, using the...

CVE-2017-11167: Improper Control of Generation of Code

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-10968

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...

CVE-2017-10968

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...

CVE-2017-10968: Improper Control of Generation of Code

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...

PT-2017-11645

Name of the Vulnerable Software and Affected Versions FineCMS through 2017-07-07 Description The issue allows remote PHP code execution. This can be achieved by placing the code after "?php" in a route=template request, specifically in the application/core/controller/template.php file...

GShark Framework - Check all your backdoors with only one telegram account

This framework can perform web post exploitation, with this you can interact with multiple web backdoor and execute custom module, script. Check all your backdoors with only one telegram messenger account! Connect web backdoor to master server and control it with Telegram Download visual backdoor...

Code injection

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

Code injection

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

PT-2017-19175

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.10.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via the database username, database host, or database password parameter in the install/save.php file. Recommendation...

CVE-2017-9741

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLESPREFIX in the configuration file...

PT-2017-19148

Name of the Vulnerable Software and Affected Versions ProjectSend version r754 Description The issue allows remote attackers to execute arbitrary PHP code via the dbprefix parameter in the install/make-config.php file, related to replacing TABLES PREFIX in the configuration file. Recommendations...