CVE-2019-7403

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import=deldir=../ URI...

EUVD-2019-17192

Malware in sbrugna...

EUVD-2021-25860

Malware in sbrugna...

CVE-2021-39503

PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without ", ?, =, ,...." In WriteConfig function, an attacker can inject php code to /include/config.cache.php file...

CVE-2020-21060

SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page...

PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2021-38773)

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in PHPMyWind v5.5 that allows a remote attacker to execute arbitrary code by injecting script into the component "/admin/webconfig.php" with the parameter...

PHPMyWind Cross-Site Scripting Vulnerability (CNVD-2021-38772)

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A cross-site scripting vulnerability exists in PHPMyWind v5.5, which allows remote attackers to execute arbitrary code by injecting script into the parameter "$cfgcopyright" in the component...

SQL Injection Vulnerability in PHPMyWind in***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind inup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

PHPMyWind Arbitrary Code Execution Vulnerability

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A security vulnerability exists in the admin/webconfig.php file in PHPMyWind version 5.5. The vulnerability can be exploited to execute arbitrary code with the help of the 'cfgauthor' field and the...

phpmywind 5.0 后台GetShell漏洞

简要描述： 这各漏洞子前被报过，但是厂商的修复不彻底。 详细说明： admin/webcongif.php 的过滤代码如下。 //强制去掉 ' //强制去掉最后一位 / $vartmp = strreplace"'",'',$row'varvalue'; ifsubstr$vartmp, -1 == '\' $vartmp = substr$vartmp,1,-1; 只过滤了最后一位的反斜杠，只需要加两个反斜杠就可以了····· 首先修改网站配置信息 configcache.php中会变成这样 $cfgwebname = '的网站'; $cfgweburl =...