10030 matches found
CVE-2018-18892
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the sitename field in mcconf.php...
CVE-2018-18892: Improper Control of Generation of Code
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the sitename field in mcconf.php...
PT-2018-14713
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows execution of arbitrary PHP code via the sitename parameter in the install.php endpoint, affecting the site name field in mc conf.php. Recommendations For MiniCMS version 1.10, consider...
Code injection
nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...
CVE-2018-18874
nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...
CVE-2018-18874: Unrestricted Upload of File with Dangerous Type
nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...
PT-2018-14707
Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10 Description The issue allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature. This can be achieved by uploading a file with a .php filename and setting the Content-Type ...
CVE-2018-18835
uploadtemplate in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file...
Cross site request forgery (csrf)
CSRF exists in zbusers/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 Zero, which allows remote attackers to execute arbitrary PHP code...
Code injection
uploadtemplate in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file...
CVE-2018-18835
uploadtemplate in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file...
CVE-2018-18842: Cross-Site Request Forgery (CSRF)
CSRF exists in zbusers/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 Zero, which allows remote attackers to execute arbitrary PHP code...
PT-2018-14683
Name of the Vulnerable Software and Affected Versions DocCms version 2016.5.12 Description The issue allows remote attackers to execute arbitrary PHP code via a template file. This is possible due to a problem in the upload template function located in the system/changeskin.php file...
PT-2018-14687
Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.2.1935 Description The issue allows remote attackers to execute arbitrary PHP code due to a CSRF vulnerability in the zb users/plugin/AppCentre/theme.js.php file. Recommendations For Z-BlogPHP version 1.5.2.1935, update t...
Notes Manager 1.0 - Arbitrary File Upload
Exploit Title: Notes Manager 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-30 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.webprojectbuilder.com/item/notes-management Software Link: https://astuteinternet.dl.sourceforge.net/project/notes-manager/notesmanagement.zip Version: 1.0...
CVE-2018-18771
An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php allows arbitrary file upload by entering a filename, directory name, and PHP code into the three text input fields...
CVE-2018-18752
Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo parameter...
CVE-2018-18752
Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo parameter...
Design/Logic Flaw
An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php allows arbitrary file upload by entering a filename, directory name, and PHP code into the three text input fields...