Webshell Bypass Vulnerability in Web Security Dog (IIS Edition) V4.0

Website Security Dog IIS Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features for comprehensive website security. Webshell bypass vulnerability exists in Web Security Dog IIS Edition V4.0. An attacker can...

File Upload Vulnerability in JEECMS v9.3

JEECMS is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with the payment and financial settlement of the content of the e-commerce as one of the conte...

File Upload Vulnerability in DESTOON B2B Website Management System

DESTOON B2B website management system is an open source B2B e-commerce industry portal solution based on PHP+MySQL. Currently, it has models of launchers, substations, malls, supply, requisition, quotation, companies, exhibitions, articles, information, PinPong, group purchasing, galleries,...

DedeCMS File Write Vulnerability

DedeCMS is a PHP-based web content management system CMS. A file write vulnerability exists in files in DedeCMS version 5.7 SP2, which can be exploited by an attacker to create a script file and obtain a webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Design/Logic Flaw

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

The connected sources confirm a concrete vulnerability in DedeCMS v5.7 SP2 (PHP-based CMS): a file-write flaw that attackers can exploit to write a script file and obtain a webshell. This CVE (CVE-2018-16785) is described as affecting DedeCMS 5.7 SP2 with XML injection/file-write mechanics enabli...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Click It Up: Targeting Local Government Payment Portals

FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...

File Upload Vulnerability in Chengdu Silo Technology Co.

Chengdu Silo Technology Co., Ltd. provides WEB-based system development, services covering web design, website program development, mainstream domain name registration, domestic and international space application, WEB system development, secondary development of WeChat, cell phone website...

File Upload Vulnerability in Laoban CMS Backend

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. File upload vulnerability exists in the background of Laoban CMS. It allows attackers to upload webshell and gain server privileges...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-19563)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A security vulnerability exists in the 'doexport' function in the app/system/feedback/admin/feedbackadmin.class.php file in MetInfo version 6.1.0. The vulnerability can be exploited ...

File Upload Vulnerability in YCCMS v3.3

YCCMS is a PHP version of a lightweight CMS builder. A file upload vulnerability exists in YCCMS v3.3. It allows attackers to upload webshell and gain server privileges...

Apache Portals Pluto 3.0.0 Remote Code Execution

Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested on: Windows Advisory:...

Apache Portals Pluto 3.0.0 - Remote Code Execution

Apache Portals Pluto 3.0.0 - Remote Code Execution Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested...

Apache Portals Pluto 3.0.0 - Remote Code Execution

Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested on: Windows Advisory:...

Hefei City, a new software development limited liability company a new housing provident fund series of software with ultra vires access vulnerability

Hefei City, a new software development limited liability company is a computer software development, promotion and provide business management consulting services based on high-tech companies. A vulnerability exists in the Hefei Yixin Software Development Limited Liability Company's Yixin Housing...

CVE-2018-1000658

LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that ca...

Unrestricted file upload

LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that ca...