9944 matches found
CVE-2018-16975: Improper Control of Generation of Code
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with...
CVE-2018-16974: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...
PT-2018-13806
Name of the Vulnerable Software and Affected Versions Elefant CMS versions prior to 2.0.7 Description The issue concerns a PHP Code Execution Vulnerability. It can be exploited by using the /filemanager/api/rm/.htaccess endpoint to remove the .htaccess file, and then using a filename that ends in...
PT-2018-13539
Name of the Vulnerable Software and Affected Versions e107 version 2.1.8 Description The issue allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the content type set to 'image/jpeg'. This is possible due to a flaw in the 'e107 web/js/plupload/upload.php' file...
CVE-2018-16388: Unrestricted Upload of File with Dangerous Type
e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...
PT-2018-13807
Name of the Vulnerable Software and Affected Versions Elefant CMS versions prior to 2.0.7 Description The issue is related to a PHP Code Execution Vulnerability. It can be exploited through the /designer/add/stylesheet.php endpoint by using a .php extension in the New Stylesheet Name field in...
Monstra CMS Arbitrary PHP Code Execution Vulnerability (CNVD-2019-03475)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An arbitrary PHP code execution vulnerability exists in Monstra CMS version 3.0.4, which stems from the...
Code injection
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a ?php substring...
CVE-2018-15886
Monstra CMS 3.0.4 is affected by a PHP code execution vulnerability via modified Snippet content, enabling arbitrary PHP code execution (e.g., via selecting admin/snippets edit and appending code after a
CVE-2018-16771
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
CVE-2018-16771
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
Sql injection
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
CVE-2018-16771
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
PT-2018-13735
Name of the Vulnerable Software and Affected Versions Hoosk version 1.7.0 Description The issue allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. Recommendations For Hoosk version 1.7.0, update to a newer version that contains a fix for thi...
CVE-2018-16771: Improper Control of Generation of Code
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...
PT-2018-13270
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...
CVE-2018-15886: Improper Control of Generation of Code
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=editsnippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a...