CVE-2020-7719

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parsestr function...

File Upload Vulnerability in WeLive Online Customer Service System of Beijing Wein Software

WeLive customer service system uses WebSocket communication technology, based on PHP development, does not rely on the official server. It supports full-duplex communication between the client browser and the remote host, that is, it allows the server to actively push information to the client,...

[SECURITY] [DSA 4719-1] php7.3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4719-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 06, 2020 https://www.debian.org/security/faq -...

WordPress Input Validation Error Vulnerability (CNVD-2021-24380)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An input validation error vulnerability exists in WordPress that originates from a web system or product that...

Unspecified Vulnerability in 2pi Software Cmfive

2pi Software Cmfive is Australia's 2pi Software's set of PHP language , mainly used for ERP systems built on open source Web application framework . A security vulnerability exists in the system/classes/DbPDO.php file in 2pi Software Cmfive versions 2015-03-15 and earlier, which can be exploited ...

The vulnerability in the implementation of the getheaders() function in the PHP interpreter allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the getheaders function implementation in the PHP programming language is related to insufficient validation of input data when processing links using the \0 symbol. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

SQL injection vulnerability in the la***_ty*** parameter of the ordasoft-cck component of Joomla!

Developed with PHP language and MySQL database, Joomla! is a content management system. A SQL injection vulnerability exists in the laty parameter of the Joomla! ordasoft-cck component. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Us*** Parameters of Joomla! ordasoft-cck Component

Developed with PHP language and MySQL database, Joomla! is a content management system. A SQL injection vulnerability exists in the Us parameter of the Joomla! ordasoft-cck component, which can be exploited by an attacker to obtain sensitive information about a database...

php: Heap buffer over-read in exif_scan_thumbnail()

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the makernote-offset relationship to valuelen...

Command Execution Vulnerability in YCCMS

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS has a command execution vulnerability that can be exploited by attackers to execute code to gain control of the server...

DEBIAN-CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support uncommon, urldecode function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes...

The vulnerability of the `link` function in the PHP programming language allows attackers to gain unauthorized access to information.

The vulnerability of the link function in the PHP programming language interpreter is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to sensitive information...

The vulnerability of the `exif_read_data` function in the PHP programming language involves an operation that goes beyond the permissible buffer size limits. This allows attackers to gain unauthorized access to information or cause service failures.

The vulnerability of the exifreaddata function in the PHP programming language is related to the execution of operations that exceed the permissible buffer limits. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information or cause service failures...

PMB 5.6 - (logid) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PMB 5.6 - 'logid' SQL Injection Google Dork: inurl:opaccss Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 -====...

PMB 5.6 - 'logid' SQL Injection

Exploit Title: PMB 5.6 - 'logid' SQL Injection Google Dork: inurl:opaccss Date: 2020-04-20 Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 -==== Software Description ====- PMB is a...

PMB 5.6 SQL Injection

Exploit Title: PMB 5.6 - 'logid' SQL Injection Google Dork: inurl:opaccss Date: 2020-04-20 Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 -==== Software Description ====- PMB is a...

PT-2020-5187 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.29 PHP versions 7.3.x through 7.3.16 PHP versions 7.4.x through 7.4.4 Description: The issue is related to the urldecode function in PHP, which can be exploited to access memory locations past the allocated buff...

The vulnerability of the fgetss() function in the general-purpose scripting language PHP, which has open source code, relates to reading beyond the buffer boundaries of memory. This allows attackers to gain access to confidential data and also trigger a denial-of-service attack.

The vulnerability of the fgetss function in the general-purpose scripting language PHP, with open source code, is related to a data reading error involving tag stripping. Exploiting this vulnerability can allow an attacker to gain access to confidential data and also cause service failures...

php: Reflected XSS on PHAR 404 page

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file...