PT-2020-7450

Name of the Vulnerable Software and Affected Versions: vTiger CRM versions 5.3 through 5.4 Description: The issue allows for arbitrary PHP code execution in the 'files' upload folder. Recommendations: For versions 5.3 through 5.4, update to a version that contains a fix for this issue. At the...

CVE-2013-3591: Unrestricted Upload of File with Dangerous Type

vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability...

PT-2020-7455

Name of the Vulnerable Software and Affected Versions: ISPConfig version 3.0.5.2 Description: The issue allows for arbitrary PHP code execution. Recommendations: For ISPConfig version 3.0.5.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2013-3214

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'...

CVE-2013-3214

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'...

PT-2020-7430

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions 5.4.0 and earlier Description: The issue is related to a PHP Code Injection Vulnerability in the 'vtigerolservice.php' file. This vulnerability allows for the injection of PHP code, potentially leading to unauthorized acce...

CVE-2013-3214: Improper Neutralization of Special Elements in Output Used by a Downstream Component

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'...

CVE-2013-2267

PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system...

CVE-2013-2267

FUDforum 3.0.4 and earlier are affected by a PHP code injection in /adm/admreplace.php due to insufficient validation of POST parameters regex_str, regex_str_opt and regex_with, allowing remote attackers to inject and execute arbitrary PHP code on the server with web server privileges (CWE-94). T...

CVE-2011-4558

Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters...

PT-2020-7140

Name of the Vulnerable Software and Affected Versions Tiki versions 8.2 and earlier Description The issue allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters. This can be exploited by providing specially crafted input to these...

CVE-2013-2267: Improper Control of Generation of Code

PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system...

PT-2020-7387

Name of the Vulnerable Software and Affected Versions: FUDforum Bulletin Board Software version 3.0.4 Description: A PHP Code Injection issue allows remote attackers to execute arbitrary code on the system. Recommendations: For FUDforum Bulletin Board Software version 3.0.4, at the moment, there ...

CVE-2012-6649

WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload...

Unrestricted file upload

WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload...

Path traversal

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

Design/Logic Flaw

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

CVE-2019-20385

The CSV upload feature in /supervisor/procesacarga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI...

AccessAlly < 3.3.2 - Unauthenticated Arbitrary PHP Code Execution

Prior to version 3.3.2, this plugin allowed arbitrary PHP code execution through the loginerror function. This exploit is out in the wild now and actively being exploited. PoC curl -Ls http://www.example.com/login/?loginerror=%3C?%20$a%20=%20getcwd;%20echo%20$a;%20?%3E...

AccessAlly < 3.3.2 - Unauthenticated Arbitrary PHP Code Execution

Prior to version 3.3.2, this plugin allowed arbitrary PHP code execution through the loginerror function. This exploit is out in the wild now and actively being exploited. curl -Ls http://www.example.com/login/?loginerror=%3C?%20$a%20=%20getcwd;%20echo%20$a;%20?%3E...