EUVD-2016-10288

Malware in sbrugna...

EUVD-2016-10299

Malware in sbrugna...

Authentication flaw

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

CVE-2016-9493 PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which m...

CVE-2016-9483 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted data

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmgfilmandownload function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obta...

CVE-2016-9484 PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any P...

CVE-2016-9493: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which m...

PT-2018-5074

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue arises from inadequate validation of user input folder directories in the generated PHP form code. This allows a remote unauthenticated attacker to perform a path...

PT-2018-5073

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue allows a remote unauthenticated attacker to inject PHP code by exploiting the deserialization of untrusted input in the phpfmg filman download function. This could al...

CVE-2016-9482: Authentication Bypass by Assumed-Immutable Data

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

PT-2018-5082

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator versions prior to 17 December 2016 Description The issue concerns the unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous...

CVE-2016-9484: Improper Limitation of a Pathname to a Restricted Directory

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any P...

CVE-2016-9492: Unrestricted Upload of File with Dangerous Type

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PH...

PT-2018-5083

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator versions prior to 17 December 2016 Description The issue concerns stored cross-site scripting in the code generated by PHP FormMail Generator. The generated form.lib.php file checks upload file types against a hard-coded...

PT-2018-5072

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator affected versions not specified Description The issue allows a remote unauthenticated user to bypass authentication and access the administrator panel. This can be achieved by navigating directly to the...

CVE-2016-9483: Deserialization of Untrusted Data

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmgfilmandownload function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obta...

PHP FormMail Generator Security Bypass Vulnerability

PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. A remote attacker can use this vulnerability to bypass authentication and gain administrator access...