Remote code execution

Remote Code Exection RCE vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters...

CVE-2021-41646

Remote Code Execution RCE vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters...

CVE-2021-41644

Remote Code Exection RCE vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters...

CVE-2021-36547

A remote code execution RCE vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36547

A remote code execution RCE vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36548

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36548

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36547

A remote code execution RCE vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-37221

CVE-2021-37221 affects Sourcecodester Customer Relationship Management System 1.0. A file-upload flaw in the account update and customer-create paths could let a remote attacker upload an arbitrary PHP file, enabling code execution on the server. Public references include an exploit in Exploit-DB...

Chi-Chen Technology Cct95 Chichen Tech Cms SQL Injection Vulnerability

Chi-Chen Technology Cct95 Chichen Tech Cms is a content management system of China's Chi-Chen Technology Chi-Chen Technology. A security vulnerability exists in Chichen Tech CMS, which stems from multiple SQL injection vulnerabilities found in the product list.php file via the id and cid...

CVE-2021-42840

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were...

CVE-2021-42840

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were...

CVE-2021-39357

The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the /class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affec...

MStore API < 3.4.5 - Unauthenticated PHP File Upload

The api/flutterwoo/configfile REST endpoint of the plugin, does not have proper authorisation in place only checking if the plugin has a license, nor enough validation against the config file sent in the request. As a result, unauthenticated users could use such endpoint to upload a PHP file,...

Gila CMS SQL注入漏洞

Gila CMS is an open source content management system CMS based on PHP and MySQL. Gila CMS version 1.11.4 suffers from a SQL injection vulnerability that can be exploited by an attacker via the $GET parameter in /src/core/controllers/cm.php...

Unrestricted PHP File Upload Over Body (CVE-2018-13038)

Unrestricted PHP File Upload Over Body...

Concrete CMS: A bypass of adding remote files in concrete5 FIlemanager leads to remote code execution

Hi, I 'm currently testing the latest concretecms on my own pc and found some security problems of file manager. Concretecms allows user to upload remote files via file manager. With some techniques to bypass restriction of this function, a evil user will be able to download arbitary php file int...

Privilege escalation

Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file...

CVE-2021-26794

Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file...

Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)

Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery CSRF Exploit Author: V1n1v131r4 Date: 2021-09-22 Vendor Homepage: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip Version: 1.20.0 Tested On: Kali Linux,...