CVE-2021-21805

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability...

SUSE SLED12: apache2-mod_php72 / php72 / php72-bcmath / php72-bz2 / etc (SUSE-SU-2021:2564-1)

The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2564-1 advisory. - CVE-2021-21705 bsc1188037: SSRF bypass in FILTERVALIDATEURL Tenable has extracted the preceding description block directly from the SUSE...

Twothink 安全漏洞

Twothink is a software application. Twothink is an open source content management framework developed using the latest ThinkPHP version 5.0.2 to provide a more convenient and secure WEB application development experience , using a new architectural design and namespace mechanism , a blend of...

The vulnerability of the _maliciousfilename function in the Archive_Tar class of the PHP classes in the PEAR library allows a malicious actor to execute arbitrary PHP code.

The vulnerability of the maliciousfilename function in the ArchiveTar class of the PHP classes in the PEAR library is related to the restoration of a unreliable data structure in memory. Exploiting this vulnerability allows an attacker to execute arbitrary PHP code using a specially crafted .tar...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

The vulnerability of the cmd.php component in the Z-BlogPHP blogging software allows a hacker to redirect users to arbitrary websites and carry out phishing attacks using a specially crafted URL.

The vulnerability of the cmd.php component in the Z-BlogPHP blog software relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites and carry out phishing attacks using specially crafted URLs...

CVE-2020-36008

OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a small and simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.10-dev2. An attacker can exploit this vulnerability to edit a page via /admin.php?action=editpage...

Command execution vulnerability in SDCMS (CNVD-2021-34455)

SDCMS is a PHP 3-in-1 website management system. SDCMS suffers from a command execution vulnerability that can be exploited by an attacker to gain system privileges...

Digital Crime Report Management System 1.0 - SQL Injection (Authentication Bypass)

Exploit Title: Digital Crime Report Management System 1.0 - SQL Injection Authentication Bypass Date: 13 April 2021 Exploit Author: Galuh Muhammad Iman Akbar GaluhID Vendor Homepage: https://iwantsourcecodes.com/digital-crime-report-management-system-in-php-with-source-code/ Software Link:...

Command execution vulnerability in SongCMS PHP version (CNVD-2021-26168)

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A command execution vulnerability exists in SongCMS PHP version. An attacker can exploit...

Command execution vulnerability in SongCMS PHP version (CNVD-2021-26158)

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A command execution vulnerability exists in SongCMS PHP version, which can be exploited ...

Command Execution Vulnerability in Extreme CMS

Extreme CMS is an open source and free CMS web content management system in PHP language. Extreme CMS has a code execution vulnerability that can be exploited by attackers to execute arbitrary code and gain server privileges...

CVE-2021-28006

Web Based Quiz System 1.0 is affected by cross-site scripting XSS in admin.php through the options parameter...

CVE-2020-36002

Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id parameter where attackers can obtain sensitive database information...

Security Bulletin: IBM API Connect is vulnerable to denial of service (DoS) via PHP (CVE-2020-7068)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-7068 DESCRIPTION: PHP is vulnerable to a denial of service, caused by the use of freed hash key in the pharparsezipfile function. By persuading a victim to open a specially crafted file, a...

CVE-2020-35396

EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...

Information Disclosure

php is vulnerable to information disclosure. The vulnerability exists as the DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte...

php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution

A vulnerability was found in PHP while using the mbstrtolower function with UTF-32LE encoding, where certain invalid strings cause PHP to overwrite the stack-allocated buffer. This flaw leads to memory corruption, crashes, and potential code execution...

SourceCodester Online Clothing Store 代码问题漏洞

SourceCodester Online Clothing Store is a website builder system from SourceCodester, Inc. that provides online clothing store functionality. A security vulnerability exists in SourceCodester Online Clothing Store version 1.0, which is caused by an arbitrary file upload in the image upload functi...