CVE-2018-17207

The Snap Creek Duplicator WordPress plugin (versions prior to 1.2.42 ) is vulnerable to arbitrary code execution due to leftover installer files, specifically installer.php and installer-backup.php, left in the filesystem after a backup restoration. An attacker can access these files to call a fu...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

PT-2018-13948

Name of the Vulnerable Software and Affected Versions Snap Creek Duplicator versions prior to 1.2.42 Description An issue allows an attacker to inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution by accessing leftover installer files, specifically...

Arbitrary PHP Code Execution

moodle/moodle is vulnerable to arbitrary code execution attacks. The vulnerability exists when importing ddwtos type by XML allows importing questions which contains PHP code which will be executed when rendered...

Moodle Remote Code Execution Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Moodle. The vulnerability can be exploited by an...

Moodle CMS 3.5.x < 3.5.2, 3.4.x < 3.4.5, 3.2.x < 3.3.8 and < 3.1.14 RCE Vulnerability - Windows

Moodle CMS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle";...

CVE-2018-14630

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' ddwtos type quiz questions, it was possible to inject and execute PHP code from within the imported question...

Remote code execution

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' ddwtos type quiz questions, it was possible to inject and execute PHP code from within the imported question...

CVE-2018-14630

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' ddwtos type quiz questions, it was possible to inject and execute PHP code from within the imported question...

CVE-2018-14630

CVE-2018-14630 affects Moodle before versions 3.5.2, 3.4.5, 3.3.8, and 3.1.14, where importing legacy drag-and-drop-into-text (ddwtos) quiz questions could inject and execute PHP code from the imported content, enabling remote code execution. The issue arises during XML import of ddwtos questions...

CVE-2018-14630

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' ddwtos type quiz questions, it was possible to inject and execute PHP code from within the imported question...

Remote code execution

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9045

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9045

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

Command injection

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

CVE-2018-17139

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

NUUO NVRMini2 Multiple Vulnerabilities

The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities: - NUUO NVRMini2 web server utilizes CGI binaries in order to handle a variety of commands that require authenticated interaction. Implemented session handling mechanism doesn't validate user's input...

PT-2018-12626

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8 moodle versions prior to 3.1.14 Description The issue allows for intentional remote code execution when importing legacy 'drag and drop into text'...

CVE-2016-9045: Deserialization of Untrusted Data

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2018-14630: Improper Input Validation

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' ddwtos type quiz questions, it was possible to inject and execute PHP code from within the imported question...