4724 matches found
EUVD-2016-8331
Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service infinite loop via a crafted Exception object in serialized data, a related issue to CVE-2015-8876...
CVE-2022-29656
Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/packagedetail.php...
EUVD-2006-4519
PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter...
EUVD-2006-4188
PHP remote file inclusion vulnerability in includes/session.php in Wheatblog wB 1.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wbclassdir parameter...
The vulnerability of the syntactic analyzer of the SOAP interpreter for the PHP programming language allows attackers to exploit it to disclose protected information.
The vulnerability of the PHP programming language interpreter is related to the exposure of protected information. Exploiting this vulnerability allows an attacker, operating remotely, to compromise protected information through the SOAP WSDL file...
The vulnerability of the OpenSSL interpreter for the PHP programming language allows a hacker to trigger a service failure.
The vulnerability of the OpenSSL interpreter for the PHP programming language is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
The vulnerability of the `process_nested_data` function in the PHP programming language allows a hacker to execute arbitrary code.
The vulnerability of the processnesteddata function in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
The vulnerability of the `ziparchive::extractto` function in the PHP programming language lies in its lack of name-based path limitation, allowing attackers to create arbitrary directories.
The vulnerability of the ziparchive::extractto function in the PHP programming language is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker to create arbitrary directories remotely...
CVE-2022-28521
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...
CVE-2022-25866
The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable$url, array $refs = NULL function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set...
Typemill 代码问题漏洞
Typemill is a lightweight flat file cms for micro publishers. A security vulnerability exists in Typemill v1.5.3, which stems from a lack of file filtering and restriction in the application upload feature. The vulnerability can be exploited by an attacker to execute arbitrary code via a...
The vulnerability of the `locale_accept_from_http` function (ext/intl/locale/locale_methods.c) in the PHP language interpreter allows a attacker to cause a service failure or potentially have other adverse effects.
The vulnerability of the localeacceptfromhttp function located in the ext/intl/locale/localemethods.c file of the PHP language interpreter involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause service failures or...
The vulnerability in the ext/date/lib/parse_date.c component of the PHP interpreter allows a attacker to compromise the confidentiality of information.
The vulnerability of the ext/date/lib/parsedate.c component of the PHP interpreter involves reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of sensitive information...
The vulnerability of the `ext/standard/var_unserializer.c` component in the PHP interpreter’s magic method allows a attacker to cause a service failure or potentially have other adverse effects.
The vulnerability of the ext/standard/varunserializer.c component of the PHP interpreter is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to cause service failures or potentially have other adverse effects through specially created...
Bakery Shop Management System 1.0 Local File Inclusion
Title: Bakery Shop Management System 1.0 LFI To RCE Author: Hejap Zairy Date: 06.04.2022 Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/ Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms0.zip Reference: https://github.com/Matrix07ksa Tested o...
Fingerprint Attendance 1.0 Account Takeover
Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Date: 29.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache...
CVE-2021-43700
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
PT-2022-17758 · Ionize · Ionize
Name of the Vulnerable Software and Affected Versions: Ionize version 1.0.8.1 Description: A remote code execution issue allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php. This is achieved by exploiting a vulnerability in the softwar...
Sports Complex Booking System 1.0 Shell Upload
Title: Sports Complex Booking System 1.0 Shell Upload Author: Hejap Zairy Date: 24.07.2022 Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs1.zip...
Inventory Management System 1.0 SQL Injection
Title: Inventory Management System 1.0 Blind SQLi To Rce Author: Hejap Zairy Date: 12.07.2022 Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache vulnerability Code php php...