Filtered by CWE-94
Filtered by vendor Subscriptions
Total 5007 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-14630 1 Moodle 1 Moodle 2024-11-21 N/A
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
CVE-2018-14579 1 Golemcms Project 1 Golemcms 2024-11-21 N/A
GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.
CVE-2018-14421 1 Seacms 1 Seacms 2024-11-21 N/A
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.
CVE-2018-14399 1 Phpcms Project 1 Phpcms 2024-11-21 N/A
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element within info[content] JSON data to the index.php?m=member&c=index&a=register URI.
CVE-2018-13818 1 Symfony 1 Twig 2024-11-21 N/A
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it
CVE-2018-13043 2 Canonical, Debian 2 Ubuntu Linux, Devscripts 2024-11-21 N/A
scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing.
CVE-2018-12995 1 Onefilecms 1 Onefilecms 2024-11-21 N/A
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen.
CVE-2018-12994 1 Onefilecms 1 Onefilecms 2024-11-21 N/A
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen.
CVE-2018-12533 1 Redhat 3 Jboss Enterprise Application Platform, Jboss Operations Network, Richfaces 2024-11-21 N/A
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
CVE-2018-12532 1 Redhat 1 Richfaces 2024-11-21 N/A
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
CVE-2018-12531 1 Metinfo 1 Metinfo 2024-11-21 N/A
An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
CVE-2018-11781 4 Apache, Canonical, Debian and 1 more 8 Spamassassin, Ubuntu Linux, Debian Linux and 5 more 2024-11-21 N/A
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
CVE-2018-11780 4 Apache, Canonical, Debian and 1 more 4 Spamassassin, Ubuntu Linux, Debian Linux and 1 more 2024-11-21 N/A
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
CVE-2018-11587 1 Centreon 2 Centreon, Centreon Web 2024-11-21 N/A
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
CVE-2018-11228 1 Crestron 8 Crestron Toolbox Protocol Firmware, Dmc-str, Tsw-1060 and 5 more 2024-11-21 N/A
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).
CVE-2018-10740 1 Axublog 1 Axublog 2024-11-21 N/A
Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php file.
CVE-2018-10642 1 Combodo 1 Itop 2024-11-21 N/A
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
CVE-2018-10574 1 Bigtreecms 1 Bigtree Cms 2024-11-21 N/A
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
CVE-2018-10517 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
CVE-2018-10515 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.