CVE-2017-11419

Fiyo CMS 2.0.7 has SQL injection in /apps/apparticle/controller/editor.php via $POST'id' and $POST'arttitle'...

Sql injection

Fiyo CMS 2.0.7 has SQL injection in /apps/apparticle/controller/editor.php via $POST'id' and $POST'arttitle'...

CSRF Vulnerability in NexusPHPV1.5 (Current Version)

NexusPHPV1.5 is a system for domestic pt stations. NexusPHPV1.5 the current version has a cross-site request forgery vulnerability, the vulnerability is due to cookie design flaws and failure to effectively limit the parameters submitted by the post. The vulnerability is caused by a cookie design...

Code injection

elog 3.1.1 allows remote attackers to post data as any username in the logbook...

UBUNTU-CVE-2016-6342

elog 3.1.1 allows remote attackers to post data as any username in the logbook...

CVE-2016-6342

Removed by vendor...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

Code injection

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

IBM Sterling B2B Integrator Security Bypass Vulnerability (CNVD-2017-15934)

IBM Sterling B2B Integrator supports highly secure integration of complex B2B processes with diverse partner communities. A security bypass vulnerability exists in IBM Sterling B2B Integrator version 5.2 that stems from the program failing to properly restrict user requests. An attacker could...

Remote code execution

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

CVE-2017-7628

The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...

CVE-2017-7402

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

UBUNTU-CVE-2015-8625

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...

Fastspot BigTree bigtree-form-builder input validation vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. bigtree-form-builder is one of the administrators used to build and collect the front-end user input information form . Fastspot BigTree bigtree-form-builder A security...

Command injection

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

Answer My Question 1.3 - SQL Injection

$POST'id' is not escaped. Url is accessible for any user. Url vulnerable : http://target/wp-content/plugins/answer-my-question/modal.php PoC...

Colorful Blog - Persistent Cross-Site Scripting

Colorful Blog - Persistent Cross-Site Scripting Exploit Title : ----------- : Colorful Blog - Stored Cross Site Scripting Author : ----------------- : Besim Google Dork : --------- : - Date : -------------------- : 13/10/2016 Type : -------------------- : webapps Platform : --------------- : PHP...

ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting

ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting Author :------------------------ : Besim Google Dork :---------------- : - Date :-------------------------- : 12/10/2016 Type :-------------------------- :...