CVE-2023-28854

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function...

CVE-2012-2227

PluXml is affected by a Local File Inclusion in update/index.php before version 5.1.6. The issue arises from using the default_lang parameter in include_once(), enabling an attacker to traverse directories and include arbitrary local files. Public disclosures and exploits reference PluXml 5.1.5 (...

CVE-2012-2227

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...

PT-2012-3893

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.1.6 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the update/index.php file. The vulnerability can b...

CVE-2012-2227: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...

CVE-2008-0459: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the update parameter...