Arbitrary File Read Vulnerability in Xinhoo OA Office System fi***.php File

Xinhu OA office system is an open source online office system. Xinhao OA office system fi.php file contains arbitrary file reading vulnerability. An attacker can use this vulnerability to download arbitrary files and obtain sensitive information...

Arbitrary file deletion vulnerability in the Ba***.cl***.php file in the background of Dream CMS

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS background Ba.cl.php file exists arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete any file on the server...

MGASA-2020-0387 Updated php packages fix a security vulnerability

In PHP versions 7.2.x when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure...

PHP 7.2.x < 7.2.33 Use After Free Vulnerability

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.33, 7.3.x prior to 7.3.21 or 7.4.x prior to 7.4.9. It is, therefore, affected by a use after free vulnerability in the pharparse function due to mishandling of the actualalias...

UBUNTU-CVE-2020-7070

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

PT-2020-16206 · D Link +1 · D-Link Dir-816L +2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L version 2.06.B09 BETA D-Link DIR-803 version 1.04.B02 Description: The issue allows for XSS via the HTTP Referer header in the webinc/js/info.php file. This typically is not exploitable due to URL encoding, except in Internet...

DEBIAN-CVE-2020-7068

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure...

SQL injection vulnerability in BEESCMS or***_sa***.php file

BEESCMS adopts PHP+MYSQL, featuring multi-language system and easy expansion of content modules. SQL injection vulnerability exists in BEESCMS orsa.php file. An attacker can exploit the vulnerability to obtain sensitive information in the database...

Low: php72, php73

Issue Overview: The flaw is in pharparsezipfile of ext/phar/zip.c. When processing a PHP archive file phar, if a persistent entry is used as defined in php.ini, then memory pointed to by the actualalias pointer is freed. Directly after the free, the actualalias pointer is passed to...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Extremenetworks Aerohive_Netconfig

CVE-2020-16152 Summary | |...

CVE-2020-19888

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

D-Link DIR-816L Cross-Site Scripting Vulnerability

The D-Link DIR-816L is a wireless AC750 dual-band cloud router. A cross-site scripting vulnerability exists in the D-Link DIR-816L. The vulnerability stems from the webinc/js/info.php file printing the RESULT parameter on a web page without applying any output filter. An attacker can exploit this...

The vulnerability of the phar_parse_pharfile function (xt/phar/phar.c) in the PHP programming language allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the pharparsepharfile function xt/phar/phar.c in the PHP programming language involves reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

S-CMS hospital website builder system aj***.php suffers from SQL injection vulnerability

S-CMS hospital station building system is developed by asp+access/mssql, easy to operate, convenient, support PC+mobile+WeChat. S-CMS hospital website builder system aj.php has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

S-CMS News Portal System aj***.php suffers from SQL Injection Vulnerability

S-CMS news portal system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station. S-CMS news portal system aj.php SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive database information...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : PHP vulnerability (USN-4375-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4375-1 advisory. It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service...

PHP Remote Code Execution Vulnerability (CVE-2019-11043).

Binary data phprcecve201911043.nbin...

DEBIAN-CVE-2019-11048

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleanin...

PHP buffer overflow vulnerability (CNVD-2020-33149)

PHP PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHPGroup and the open source community. The language is mainly used for Web development, supports a variety of databases and operating systems. A...

Online Clothing Store Arbitrary File Upload Vulnerability

Online Clothing Store is a PHP program that allows you to buy clothes through an online service. An arbitrary file upload vulnerability exists in Online Clothing Store. An attacker can exploit the vulnerability to upload php files and gain server privileges...