CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

Design/Logic Flaw

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

CVE-2023-49103

The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...

ownCloud Security Breach

ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in ownCloud graphapi versions prior to 0.2.1, 0.3.1 and 0.3.1. The vulnerability stems from the fact that the graphapi application relies on the third-party GetPhpInfo.php...

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error,...

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. PoC Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error...

CVE-2023-46042

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo...

CVE-2023-46042

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo...

CVE-2023-46042

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo...

CVE-2023-46042

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo...

PT-2023-29812 · Unknown · Getsimple Cms

Name of the Vulnerable Software and Affected Versions: GetSimpleCMS version 3.4.0a Description: An issue in GetSimpleCMS allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo function. Recommendations: For GetSimpleCMS version 3.4.0a, update to a version that fix...

CVE-2023-39677

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php...

CVE-2023-39677

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php...

Information disclosure

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php...

CVE-2023-39677

CVE-2023-39677 corresponds to a PHPInfo disclosure in PrestaShop modules MyPrestaModules (Module v6.2.9) and UpdateProducts (Module v3.6.9) via the send.php endpoint. The NVD entry notes a CVSS v3.1 base score of 7.5 (High) with network attack vector, no privileges required, no user interaction, ...

CVE-2023-39677

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php...

CVE-2023-39677

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php...

soosyze 2.0.0 - File Upload Exploit

Title: soosyze 2.0.0 - File Upload Author: nu11secur1ty Vendor: https://soosyze.com/ Software: https://github.com/soosyze/soosyze/releases/tag/2.0.0 Reference: https://portswigger.net/web-security/file-upload Description: Broken file upload logic. The malicious user can upload whatever he wants t...

PT-2023-27068 · Prestashop · Updateproducts Prestashop Module +1

Name of the Vulnerable Software and Affected Versions: MyPrestaModules Prestashop Module version 6.2.9 UpdateProducts Prestashop Module version 3.6.9 Description: A PHPInfo information disclosure issue was discovered in the send.php file, allowing potential access to sensitive information...