CVE-2024-7094: Improper Control of Generation of Code

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which...

FineCMS 1.0 Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: FineCMS 1.0 Multiple Vulnerabilities Dork: N/A Date: 29.08.2017 Vendor Homepage : http://mvc.net.pl/ Software Link: https://github.com/andrzuk/FineCMS Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Explo...

FineCMS multi vulnerablity

Reflected XSS in getimage.php Technical Description: file /application/lib/ajax/getimage.php the $POST'id' and $POST'name' and $GET'folder' without any validated, sanitised or output encoded. Proof of ConceptPoC http://yourfinecms/application/lib/ajax/getimage.php?folder=1 POST: id=1"alert1&name=...

CVE-2017-11178: Insufficient Verification of Data Authenticity

In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...

ezStats2 Serverviewer 0.62 Local File Inclusion Vulnerability

ezStats2 Serverviewer version 0.62 suffers from a local file inclusion vulnerability. Exploit Title: ezStats2 Serverviewer v0.62 Local File Inclusion Vulnerability Date: 02/05/2013 Author: L0n3ly-H34rT Contact: email protected My Site: http://se3c.blogspot.com/ Vendor Link: http://www.ezstats.org...

CVE-2007-3214: Undefined Security Weakness

SQL injection vulnerability in style.php in e-Vision CMS 2.02 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the template parameter...