EUVD-2021-34798

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Attackers can upload a crafted theme package through the theme.php endpoint that deploys a web shell ...

CVE-2021-47937: Unrestricted Upload of File with Dangerous Type

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Attackers can upload a crafted theme package through the theme.php endpoint that deploys a web shell ...

CVE-2020-20919

File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file...

CVE-2024-50809

The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands...

CVE-2024-50809

The SDCMS 2.8 enterprise website content management system contains a command execution vulnerability within the theme.php file. This flaw allows an attacker to execute arbitrary system commands on the underlying server. Impact of this vulnerability is considered high, with potential for total im...

CVE-2024-50809: Improper Neutralization of Special Elements used in an OS Command

The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands...

CVE-2024-50809

The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands...

CVE-2024-50809

The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands...

CVE-2023-6613: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the component Logo Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2020-20919

File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file...

CVE-2020-20919

File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file...

Unrestricted file upload

File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file...

CVE-2020-20919: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file...

Server side request forgery (ssrf)

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

CVE-2022-41477: Server-Side Request Forgery (SSRF)

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

CVE-2022-41477

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

CVE-2018-10228: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changescp parameter to the index.php/admin/themes/sa/templatesavechanges URI...

PT-2021-8668

Name of the Vulnerable Software and Affected Versions LimeSurvey version 3.6.2+180406 Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the changes cp parameter to the...

Cross-site Scripting (XSS) - Generic in emoncms/emoncms

✍️ Description Line 94 of theme.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtinecho in theme.php at line 94. 🕵️‍♂️ Proof of Concept $q = ""; if isset$GET'q' $q = $GET'q'; //get in line 16 //print in line...

CVE-2020-23181: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting XSS vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field...