SUSE CVE-2024-8929

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server...

WordPress WP Time Capsule Arbitrary File Upload to RCE

This module exploits an arbitrary file upload vulnerability in the WordPress WP Time Capsule plugin versions use exploit/multi/http/wp/timecapsulefileuploadrce msf undefinedtimecapsulefileuploadrce show actions ...actions... msf undefinedtimecapsulefileuploadrce set ACTION msf...

PT-2024-8896

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. before 8.1.31 PHP versions 8.2. before 8.2.26 PHP versions 8.3. before 8.3.14 Description: The issue is related to insufficient protection of internal data due to a buffer overflow in memory, which can be exploited by a...

PT-2024-8888

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. before 8.1.31 PHP versions 8.2. before 8.2.26 PHP versions 8.3. before 8.3.14 Description: The issue is related to the configuration of the request fulluri option in PHP, which can lead to HTTP request smuggling when using...

CVE-2023-29126

CVE-2023-29126 affects Waybox Enel X web management application (Waybox Enel X / JuiceBox). Reports describe a PHP-type juggling vulnerability that may allow a brute-force process and, under certain conditions, authentication bypass. Concrete details on affected versions are not consistently prov...

RHEL 6 / 7 : php55-php (RHSA-2016:1611)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1611 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: It was discovered that PHP did not properly...

RHEL 4 : php (RHSA-2014:1825)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1825 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A stack-based buffer overflow flaw was found in the way the...

CBL Mariner 2.0 Security Update: php (CVE-2024-8926)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8926 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non- standard...

CBL Mariner 2.0 Security Update: php (CVE-2024-8927)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8927 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used ...

CBL Mariner 2.0 Security Update: php (CVE-2024-8925)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8925 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form...

PT-2024-16329 · Unknown · Codezips Online Institute Management System

Name of the Vulnerable Software and Affected Versions: Codezips Online Institute Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file /login.php. The manipulation of the email argument leads to sql injection. The attack can...

CVE-2024-50435

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Theme Horse Meta News.This issue affects Meta News: from n/a through 1.1.7...

WordPress plugin Point Maker 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39388 · WordPress · Wordpress File Upload

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin versions up to, and including, 4.24.11 Description: The WordPress File Upload plugin is vulnerable to Path Traversal via the wfu file downloader.php file. This allows unauthenticated attackers to read or delete...

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

DEBIAN-CVE-2024-8927

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

CVE-2024-8925

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to...

Amazon Linux 2 : php (ALASPHP8.2-2024-005)

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory. In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

WordPress Empowerment theme <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme Empowerment versions = 1.0.2...

WordPress plugin Empowerment 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...