CVE-2018-19127

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cachetemplate/.tpl.php file...

CVE-2018-19127

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cachetemplate/.tpl.php file...

PT-2018-14819

Name of the Vulnerable Software and Affected Versions PHPCMS 2008 Description A code injection issue in the /type.php file allows attackers to execute arbitrary code by writing PHP code to a cache file with a controllable filename. The PHP code is sent via the template parameter and is written to...

CVE-2018-7768

The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the tpl input parameter...

CVE-2018-8763: Improper Neutralization of Input During Web Page Generation

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=renameform URI...

Monsta Box WebFTP Arbitrary File Read

Application ----------- "MONSTA Box is a lightweight open-source file manager you can install on your website or server to easily manage your files through any browser." Description from the official website http://www.monstahq.com/ Vulnerability ------------- The Monsta Box WebFTP application...

PT-2015-6434

Name of the Vulnerable Software and Affected Versions zM Ajax Login & Register plugin versions prior to 1.1.0 Description The issue allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a "load template" action to...

FarsiNews 2.1/2.5 show_archives.php template Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/16580/info FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit the...

CVE-2012-5224

PHP remote file inclusion vulnerability in vb/includes/vbacmpsincludebottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pagestemplate parameter...

CVE-2012-2202

CVE-2012-2202 is a directory-traversal vulnerability affecting IBM Lotus Protector for Mail Security (versions 2.1, 2.5, 2.5.1, 2.8) and IBM Proventia Network Mail Security System. The issue is in javatester_init.php where an unvalidated parameter (after authentication) enables an arbitrary file ...

PT-2012-3877

Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.1 through 2.8 IBM ISS Proventia Network Mail Security System affected versions not specified Description The issue allows remote authenticated administrators to read arbitrary files via a .. dot...

CVE-2012-2202: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in javatesterinit.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. dot dot in the template parameter...

CVE-2011-4832: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the template parameter in a template action...

PT-2011-5132

Name of the Vulnerable Software and Affected Versions CaupoShop Pro versions 2.x through 3.70 CaupoShop Classic version 3.01 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the template parameter in a template action. This is a directory traversal...

CVE-2011-4543

Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 set or 2 module parameter to a OM/Core/Site/Admin/Application/templatesmodules/pages/info.php, b...

phpcms 2008 product.php pagesize参数代码注射漏洞

PHPCMS是国内领先的网站管理系统，同时也是一个开源的PHP开发框架。 PHPCMS 2008在处理某些模板参数时存在安全漏洞，其yp/product.php页面的pagesize参数没有正确进行检查过滤，导致可以提交任意字符，远程攻击者可利用此漏洞执行任意命令 具体的代码触发路径是这样的： phpcms/yp/product.php中获取pagesize参数，拼接为$urlrule变量。随后将之带入yp目录下的product.html模板之中。在模板执行后，进入到get函数处理中，最后经过get-pages-pageurl函数，最终触发pageurl的如下代码： eval"$url ...

Pecio CMS 'template' Multiple Remote File Include Vulnerabilities

This host is running Pecio CMS and is prone to multiple remote file inclusion vulnerabilities. OpenVAS Vulnerability Test $Id: gbpeciocmsmultrfivuln.nasl 5323 2017-02-17 08:49:23Z teissa $ Pecio CMS 'template' Multiple Remote File Include Vulnerabilities Authors: Madhuri D Copyright: Copyright c...

CVE-2010-3204: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to 1 post.php, 2 article.php, 3 blog.php, or 4 home.php in pectemplates/nova-blue/...

CVE-2009-3849

Multiple stack-based buffer overflows in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via 1 a long Template parameter to nnmRptConfig.exe, related to the strcat function; or 2 a long Oid parameter to snmp.exe...

CVE-2009-3848

Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Template parameter, related to the vsprintf function...