17 matches found
Command injection
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/webconfig.php'...
CVE-2020-18885
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/webconfig.php'...
CVE-2020-18885: Improper Neutralization of Special Elements used in a Command
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/webconfig.php'...
Cross site scripting
Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgcopyright" of component " /admin/webconfig.php"...
CVE-2020-18229: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgcopyright" of component " /admin/webconfig.php"...
CVE-2020-18230: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgswitchshow" of component " /admin/webconfig.php"...
CVE-2018-17131
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...
CVE-2018-17134
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...
Design/Logic Flaw
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field...
CVE-2018-17134
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...
CVE-2018-17131
CVE-2018-17131 affects PHPMyWind 5.5: admin/web_config.php allows an admin to execute arbitrary code via the varvalue field due to improper input handling. This results in arbitrary code execution with admin privileges; CVSS scores indicate MEDIUM to HIGH impact across versions. Exploitation deta...
CVE-2018-17133
CVE-2018-17133 affects PHPMyWind 5.5, where admin/web_config.php allows an Admin user to execute arbitrary code via the rewrite url setting. Root cause is improper handling of URL rewrite configuration leading to code execution with admin privileges. Impact is arbitrary code execution; CVSS notes...
CVE-2018-17134
CVE-2018-17134 affects PHPMyWind 5.5. The vulnerability is an arbitrary code execution flaw in admin/web_config.php that can be exploited by Admin users through the cfg_author field in combination with a crafted cfg_webpath field. The connected documents corroborate the affected product/version a...
PHPMyWind Arbitrary Code Execution Vulnerability
PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A security vulnerability exists in the admin/webconfig.php file in PHPMyWind version 5.5. The vulnerability can be exploited to execute arbitrary code with the help of the 'cfgauthor' field and the...
CVE-2018-17134: Improper Control of Generation of Code
admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfgauthor field in conjunction with a crafted cfgwebpath field...