CVE-2018-0001

A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions...

b2evolution PHP Code Execution Vulnerability

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. A PHP code execution vulnerability exists in the basic installation functionality of b2evolution versions 6.6.0 through 6.8.10. An attacker can exploit this vulnerability to execute PHP code...

WDMyCloud < 2.30.165 - Multiple Vulnerabilities

WDMyCloud Multiple Vulnerabilities Vendor: Western Digital Product: WDMyCloud Version: = 2.30.165 Website: https://www.wdc.com/products/network-attached-storage.html / / / / / / / / / / / / / / / / / / / / / \ / // / // / / / / / / / // / / / /,/// // /// // GulfTech Research and Development...

FS Ebay Clone SQL Injection Vulnerability

FS Ebay Clone is an online auction and shopping website script based on PHP and MySQL. A SQL injection vulnerability exists in FS Ebay Clone version 1.0. A remote attacker can inject SQL into the product.php file by sending the 'id' parameter to the product.php file, or the search.php file by...

Fiyo CMS SQL Injection Vulnerability (CNVD-2018-00247)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /system/site.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to retrieve data from the database...

LvyeCMS Public tologin function cross-site scripting vulnerability

LvyeCMS is a content management system developed using the ThinkPHP framework and an independent grouping approach. A cross-site scripting vulnerability exists in the Public tologin function of the admin.php file in LvyeCMS 3.1 and earlier versions. A remote attacker can exploit this vulnerabilit...

I, Librarian Catalog Enumeration Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A security vulnerability exists in the jqueryFileTree.php file in Scilico I, Librarian versions 4.6 and earlier and 4.7. An attacker can exploit the vulnerability to enumerate directories...

zorovavi/blog SQL Injection Vulnerability

zorovavi/blog is a blogging system. A SQL injection vulnerability exists in zorovavi/blog 2017-10-17 and earlier. A remote attacker can exploit the vulnerability by sending the 'id' parameter to the recept.php file to upload arbitrary files...

CVE-2011-4334

edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter...

CVE-2017-14414

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 devices have XSS in the action parameter to htdocs/web/shareport.php...

Wordpress SQLi

Source 1:https://medium. com/websec/wordpress-sqli-bbb2afcc8e94 Wordpress SQLi There won't be an intro, let us jump to the problem. This is the wordpress database abstraction the prepare method code: public function prepare $query, $args if isnull $query return; // This is not meant to be foolpro...

PHP ext/standard/var_unserializer.re Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A buffer overflow vulnerability exists in PHP ext/standard/varunserializer.re, which could be exploited by remote attackers to submit a special request and execute arbitrar...

PHP ext/standard/var_unserializer.re heap buffer overflow vulnerability (CNVD-2017-29192)

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A heap buffer overflow vulnerability exists in PHP ext/standard/varunserializer.re, which could be exploited by remote attackers to submit a special request and execute...

The vulnerability of the /ext/phar/phar_object.c component of the PHP interpreter allows a attacker to execute arbitrary code.

The vulnerability of the /ext/phar/pharobject.c component of the PHP interpreter is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2017-11155

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors...

Information disclosure

The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the...

The vulnerability of the msgfmt_parse_message function in the PHP interpreter allows a attacker to trigger a service failure or exert other effects.

The vulnerability of the msgfmtparsemessage function in the PHP interpreter arises due to an overflow in the stack buffer. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause a service failure termination of the application or other effects within the UNIX/ICOM...

CVE-2017-11362

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformatparse.c does not restrict the locale length, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact within International...

PHP Security Bypass Vulnerability (CNVD-2017-23336)

PHP PHP: HypertextPreprocessor is an open source general-purpose computer scripting language maintained by the PHPGroup and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and program extensions in C and C++. A security vulnerability...

PHP Denial of Service Vulnerability (CNVD-2017-22592)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A security vulnerability exists in the WDDX deserialization process for the 'boolean' parameter in the ext/wddx/wddx.c file in PHP versions prio...