Cross-site scripting in PHPMailer

PHPMailer versions prior to 5.2.24 released July 26th 2017 have an XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it i...

Arbitrary File Upload

Overview verot/class.upload.php is a PHP class that can be used to upload files and manipulate images very easily. Affected versions of this package are vulnerable to Arbitrary File Upload. The following extensions could be used to bypass the blacklist provided by the package and achieve code...

Dotclear Arbitrary PHP Code Execution Vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A security vulnerability exists in the inc/core/class.dc.core.php file in versions of Dotclear prior to 2.8.2. A remote attacker can exploit this vulnerability by uploading a file...