ByteOS Network

Vulnerability Details :

CVE-2015-0845

Assigner-debian

Assigner Org ID-79363d38-fa19-49d1-9214-5f28da3f3ac5

Published At-17 Apr, 2015 | 17:00

Updated At-06 Aug, 2024 | 04:26

Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:debian

Assigner Org ID:79363d38-fa19-49d1-9214-5f28da3f3ac5

Published At:17 Apr, 2015 | 17:00

Updated At:06 Aug, 2024 | 04:26

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.debian.org/security/2015/dsa-3227	vendor-advisory x_refsource_DEBIAN
http://www.securitytracker.com/id/1032153	vdb-entry x_refsource_SECTRACK
https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html	x_refsource_CONFIRM

Hyperlink: http://www.debian.org/security/2015/dsa-3227

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://www.securitytracker.com/id/1032153

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.debian.org/security/2015/dsa-3227	vendor-advisory x_refsource_DEBIAN x_transferred
http://www.securitytracker.com/id/1032153	vdb-entry x_refsource_SECTRACK x_transferred
https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.debian.org/security/2015/dsa-3227

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: http://www.securitytracker.com/id/1032153

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@debian.org

Published At:17 Apr, 2015 | 17:59

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

sixapart>>movabletype>>Versions up to 5.2.11(inclusive)

cpe:2.3:a:sixapart:movabletype:*:*:*:*:advanced:*:*:*

sixapart>>movabletype>>Versions up to 5.2.11(inclusive)

cpe:2.3:a:sixapart:movabletype:*:*:*:*:open_source:*:*:*

sixapart>>movabletype>>Versions up to 5.2.11(inclusive)

cpe:2.3:a:sixapart:movabletype:*:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0

cpe:2.3:a:sixapart:movabletype:6.0:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0

cpe:2.3:a:sixapart:movabletype:6.0:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.1

cpe:2.3:a:sixapart:movabletype:6.0.1:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.1

cpe:2.3:a:sixapart:movabletype:6.0.1:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.2

cpe:2.3:a:sixapart:movabletype:6.0.2:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.2

cpe:2.3:a:sixapart:movabletype:6.0.2:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.3

cpe:2.3:a:sixapart:movabletype:6.0.3:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.3

cpe:2.3:a:sixapart:movabletype:6.0.3:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.4

cpe:2.3:a:sixapart:movabletype:6.0.4:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.4

cpe:2.3:a:sixapart:movabletype:6.0.4:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.5

cpe:2.3:a:sixapart:movabletype:6.0.5:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.5

cpe:2.3:a:sixapart:movabletype:6.0.5:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.6

cpe:2.3:a:sixapart:movabletype:6.0.6:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.6

cpe:2.3:a:sixapart:movabletype:6.0.6:*:*:*:pro:*:*:*

sixapart>>movabletype>>6.0.7

cpe:2.3:a:sixapart:movabletype:6.0.7:*:*:*:advanced:*:*:*

sixapart>>movabletype>>6.0.7

cpe:2.3:a:sixapart:movabletype:6.0.7:*:*:*:pro:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.debian.org/security/2015/dsa-3227	security@debian.org	N/A
http://www.securitytracker.com/id/1032153	security@debian.org	N/A
https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html	security@debian.org	Vendor Advisory
http://www.debian.org/security/2015/dsa-3227	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id/1032153	af854a3a-2127-422b-91ae-364da2661108	N/A
https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: http://www.debian.org/security/2015/dsa-3227

Source: security@debian.org

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1032153

Source: security@debian.org

Resource: N/A

Hyperlink: https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html

Source: security@debian.org

Resource:

Vendor Advisory

Hyperlink: http://www.debian.org/security/2015/dsa-3227

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1032153

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

893Records found

CVE-2007-6029

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.70% / 81.55%

7 Day CHG~0.00%

Published-20 Nov, 2007 | 02:00

Updated-16 Sep, 2024 | 16:33

Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.

Vendor-clam_anti-virus n/a

Product-clamav n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4471

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.12%

7 Day CHG~0.00%

Published-30 Dec, 2009 | 21:00

Updated-07 Aug, 2024 | 07:01

Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CLASSPATH parameter to (1) bib_form.php, (2) bib_pldetails.php, (3) bib_plform.php, (4) bib_plsearchc.php, (5) bib_plsearchs.php, (6) bib_save.php, (7) bib_searchc.php, (8) bib_searchs.php, (9) edi_form.php, (10) edi_save.php, (11) gen_form.php, (12) gen_save.php, (13) lin_form.php, (14) lin_save.php, (15) luo_form.php, (16) luo_save.php, (17) sog_form.php, or (18) sog_save.php in biblioteca/; (19) cal_insert.php, (20) cal_save.php, or (21) cal_saveactivity.php in calendario/; (22) circolari/cir_save.php; or (23) modulistica/mdl_save.php.

Vendor-freeschool n/a

Product-freeschool n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3822

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.57% / 80.77%

7 Day CHG~0.00%

Published-28 Oct, 2009 | 10:00

Updated-17 Sep, 2024 | 03:18

PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat (com_ajaxchat) component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.

Vendor-fijiwebdesign n/a Joomla!

Product-joomla\!com_ajaxchat n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4622

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-18 Jan, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-0572.

Vendor-legrinder n/a

Product-drunken\n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4614

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-18 Jan, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the MOA_PATH parameter to (1) _error_funcs.php, (2) _integrity_funcs.php, (3) _template_component_admin.php, (4) _template_component_gallery.php, (5) _template_parser.php, (6) mod_gallery_funcs.php, (7) mod_image_funcs.php, (8) mod_tag_funcs.php, (9) mod_tag_view.php, (10) mod_upgrade_funcs.php, (11) mod_user_funcs.php, (12) page_admin.php, (13) page_gallery_add.php, (14) page_gallery_view.php, (15) page_image_add.php, (16) page_image_view_full.php, (17) page_login.php, and (18) page_sitemap.php in sources/.

Vendor-dan_brown n/a

Product-moa_gallery n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4094

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.90% / 74.76%

7 Day CHG~0.00%

Published-27 Nov, 2009 | 20:45

Updated-07 Aug, 2024 | 06:54

PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.

Vendor-designforjoomla n/a Joomla!

Product-com_ezine joomla\!n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3541

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-02 Oct, 2009 | 19:00

Updated-07 Aug, 2024 | 06:31

PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the DataDirectory parameter.

Vendor-phpgenealogy n/a

Product-phpgenealogy n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2007-4806

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-6.45% / 90.68%

7 Day CHG~0.00%

Published-11 Sep, 2007 | 18:00

Updated-07 Aug, 2024 | 15:08

PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter.

Vendor-focus_sis n/a

Product-focus_sis n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3323

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation System mini (BAROSmini) 0.32.595 allow remote attackers to execute arbitrary PHP code via a URL in the baros_path parameter to (1) include/common_functions.php, and the main_path parameter to (2) lib_users.php, (3) lib_stats.php, and (4) lib_slots.php in include/lib/.

Vendor-robig n/a

Product-barosmini n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3065

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.85% / 73.95%

7 Day CHG~0.00%

Published-03 Sep, 2009 | 17:00

Updated-07 Aug, 2024 | 06:14

PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the highlighter parameter.

Vendor-rein_velt n/a

Product-vedit n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3511

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.58% / 67.96%

7 Day CHG~0.00%

Published-01 Oct, 2009 | 14:00

Updated-07 Aug, 2024 | 06:31

Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fs_jVroot parameter to (1) sites/site/pages/index.php, (2) sites/test/pages/contact.php, (3) system/pageTemplate.php, and (4) system/utilities.php.

Vendor-fh54 n/a

Product-justvisual n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3317

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.11%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary PHP code via a URL in the path parameter, a different vector than CVE-2008-0648.

Vendor-thecodeweasel n/a

Product-opensiteadmin n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3492

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-30 Sep, 2009 | 15:00

Updated-07 Aug, 2024 | 06:31

Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in lib/Loggix/Module/; and (5) modules/downloads/lib/LM_Downloads.php.

Vendor-gotdns n/a

Product-loggix_project n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2633

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.61% / 68.78%

7 Day CHG~0.00%

Published-28 Jul, 2009 | 19:06

Updated-07 Aug, 2024 | 05:59

PHP remote file inclusion vulnerability in toolbar_ext.php in the VehicleManager (com_vehiclemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Vendor-ordasoft n/a Joomla!

Product-joomla com_vehiclemanager n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3174

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.23%

7 Day CHG~0.00%

Published-11 Sep, 2009 | 20:00

Updated-07 Aug, 2024 | 06:14

PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin_lib parameter.

Vendor-odelao n/a

Product-obophix n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3188

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.73% / 71.75%

7 Day CHG~0.00%

Published-15 Sep, 2009 | 21:00

Updated-07 Aug, 2024 | 06:14

PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save parameter.

Vendor-david_frohlich n/a

Product-phpsane n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2773

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.24% / 78.46%

7 Day CHG~0.00%

Published-14 Aug, 2009 | 17:00

Updated-07 Aug, 2024 | 05:59

PHP remote file inclusion vulnerability in home.php in PHP Paid 4 Mail Script allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

Vendor-shop-020 n/a

Product-php_paid_4_mail_script n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3362

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.97% / 75.69%

7 Day CHG~0.00%

Published-24 Sep, 2009 | 16:00

Updated-16 Sep, 2024 | 17:22

PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.

Vendor-sznews n/a

Product-sznews n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3333

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.86% / 74.15%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com_koesubmit) component 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Vendor-alibasta n/a MamboServer

Product-com_koesubmit mambo n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2014-3927

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.16% / 77.71%

7 Day CHG~0.00%

Published-03 Apr, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.

Vendor-mrlg4php_project n/a

Product-mrlg4php n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3220

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.76% / 72.36%

7 Day CHG~0.00%

Published-16 Sep, 2009 | 19:00

Updated-07 Aug, 2024 | 06:22

PHP remote file inclusion vulnerability in cp_html2txt.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

Vendor-tecnick n/a

Product-aiocp n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-21652

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.95% / 85.93%

7 Day CHG~0.00%

Published-06 Oct, 2021 | 21:33

Updated-04 Aug, 2024 | 14:30

Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() method.

Vendor-myucms_project n/a

Product-myucms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2017-7691

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.59% / 68.21%

7 Day CHG~0.00%

Published-11 Apr, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The vendor response is SAP Security Note 2419592.

Vendor-n/a SAP SE

Product-trex n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3114

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.77% / 72.58%

7 Day CHG~0.00%

Published-09 Sep, 2009 | 22:00

Updated-07 Aug, 2024 | 06:14

The RSS reader widget in IBM Lotus Notes 8.0 and 8.5 saves items from an RSS feed as local HTML documents, which allows remote attackers to execute arbitrary script in Internet Explorer's Local Machine Zone via a crafted feed, aka SPR RGAU7RDJ9K.

Vendor-n/a IBM Corporation

Product-lotus_notes n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2635

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.23%

7 Day CHG~0.00%

Published-28 Jul, 2009 | 19:06

Updated-07 Aug, 2024 | 05:59

PHP remote file inclusion vulnerability in toolbar_ext.php in the RealEstateManager (com_realestatemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Vendor-ordasoft n/a Joomla!

Product-joomla com_realestatemanager n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2634

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.61% / 68.78%

7 Day CHG~0.00%

Published-28 Jul, 2009 | 19:06

Updated-07 Aug, 2024 | 05:59

PHP remote file inclusion vulnerability in toolbar_ext.php in the MediaLibrary (com_media_library) component 1.5.3 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Vendor-ordasoft n/a Joomla!

Product-joomla com_medialibrary n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3306

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.17% / 77.75%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter.

Vendor-richrumble n/a

Product-clearsite n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3324

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.23%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sPath parameter.

Vendor-andres_g_aragoneses n/a

Product-prodler n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-21784

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.48% / 64.24%

7 Day CHG~0.00%

Published-24 Jun, 2021 | 15:29

Updated-04 Aug, 2024 | 14:30

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.

Vendor-phpwcms n/a

Product-phpwcms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-21651

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-3.52% / 87.16%

7 Day CHG~0.00%

Published-06 Oct, 2021 | 21:33

Updated-04 Aug, 2024 | 14:30

Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the add() method.

Vendor-myucms_project n/a

Product-myucms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3056

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.59% / 68.23%

7 Day CHG~0.00%

Published-03 Sep, 2009 | 17:00

Updated-07 Aug, 2024 | 06:14

PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[AdminPath] parameter.

Vendor-bas_bloemsaat n/a

Product-kingcms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-3055

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.86% / 74.15%

7 Day CHG~0.00%

Published-03 Sep, 2009 | 17:00

Updated-07 Aug, 2024 | 06:14

PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dle_config_api parameter.

Vendor-dlecms n/a

Product-dle n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2143

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.24% / 78.39%

7 Day CHG~0.00%

Published-22 Jun, 2009 | 14:00

Updated-07 Aug, 2024 | 05:36

PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.

Vendor-firestats n/a WordPress.org

Product-wordpress firestats n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-20298

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.44% / 90.67%

7 Day CHG~0.00%

Published-18 Dec, 2020 | 19:00

Updated-04 Aug, 2024 | 14:15

Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands.

Vendor-zzzcms n/a

Product-zzzphp n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2007-1148

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.14% / 83.53%

7 Day CHG~0.00%

Published-27 Feb, 2007 | 18:00

Updated-07 Aug, 2024 | 12:43

PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.

Vendor-lovecms n/a

Product-lovecms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-1719

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-3.87% / 87.76%

7 Day CHG~0.00%

Published-16 Jun, 2009 | 23:00

Updated-07 Aug, 2024 | 05:20

The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.

Vendor-n/a Apple Inc.Sun Microsystems (Oracle Corporation)

Product-jre mac_os_x_server mac_os_x n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-1822

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.82% / 73.50%

7 Day CHG~0.00%

Published-29 May, 2009 | 16:24

Updated-07 Aug, 2024 | 05:27

Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or (2) mp3captcha.php in assets/captcha/includes/captchaform/, or (3) assets/captcha/includes/captchatalk/swfmovie.php.

Vendor-gonzalo_maser n/a Joomla!

Product-joomla\!com_artforms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2008-6402

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.02% / 76.32%

7 Day CHG~0.00%

Published-06 Mar, 2009 | 11:00

Updated-07 Aug, 2024 | 11:27

PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mod_dir parameter.

Vendor-muskatli n/a

Product-sofi_webgui n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-18185

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.83%

7 Day CHG~0.00%

Published-02 Oct, 2020 | 12:50

Updated-04 Aug, 2024 | 14:00

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.

Vendor-pluxml n/a

Product-pluxml n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-18172

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.51% / 65.50%

7 Day CHG~0.00%

Published-26 Jul, 2021 | 18:26

Updated-04 Aug, 2024 | 14:00

A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.

Vendor-trezor n/a

Product-bridge n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2262

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.49% / 64.54%

7 Day CHG~0.00%

Published-30 Jun, 2009 | 10:00

Updated-07 Aug, 2024 | 05:44

PHP remote file inclusion vulnerability in install/di.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtoserverdata parameter. NOTE: the installation instructions specify deleting the install/ folder.

Vendor-myiosoft n/a

Product-ajaxportal n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2008-6022

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.94% / 75.30%

7 Day CHG~0.00%

Published-02 Feb, 2009 | 21:29

Updated-07 Aug, 2024 | 11:13

PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1, allows remote attackers to execute arbitrary PHP code via a URL in the ugamela_root_path parameter.

Vendor-xnova n/a

Product-xnova n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2378

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.50% / 64.73%

7 Day CHG~0.00%

Published-08 Jul, 2009 | 15:00

Updated-07 Aug, 2024 | 05:52

PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.

Vendor-jtr n/a

Product-jax_formmailer n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2008-5922

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.26% / 78.55%

7 Day CHG~0.00%

Published-21 Jan, 2009 | 18:00

Updated-07 Aug, 2024 | 11:13

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) main and (2) right parameters.

Vendor-cfagcms n/a

Product-cfagcms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-2331

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.10% / 77.09%

7 Day CHG~0.00%

Published-05 Jul, 2009 | 16:00

Updated-07 Aug, 2024 | 05:44

Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.

Vendor-cms.tut.su n/a

Product-cms_chainuk n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-0820

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-8.10% / 91.79%

7 Day CHG~0.00%

Published-05 Mar, 2009 | 02:00

Updated-16 Sep, 2024 | 17:24

Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php. NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.

Vendor-php.brickhost n/a

Product-phpscheduleit n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-1450

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.58% / 67.96%

7 Day CHG~0.00%

Published-28 Apr, 2009 | 15:00

Updated-07 Aug, 2024 | 05:13

PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the _page_content parameter.

Vendor-bluevirus-design n/a

Product-sma-db n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2006-7106

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.00% / 82.93%

7 Day CHG~0.00%

Published-03 Mar, 2007 | 21:00

Updated-07 Aug, 2024 | 20:50

PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.

Vendor-powerphlogger n/a

Product-powerphlogger n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-1463

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.73% / 71.67%

7 Day CHG~0.00%

Published-28 Apr, 2009 | 16:00

Updated-07 Aug, 2024 | 05:13

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.

Vendor-razorcms n/a

Product-razorcms n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-1551

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-8.01% / 91.74%

7 Day CHG~0.00%

Published-06 May, 2009 | 15:00

Updated-07 Aug, 2024 | 05:20

Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web_path parameter to qte_web.php and the (2) qte_root parameter to bin/qte_init.php.

Vendor-qt-cute n/a

Product-quickteam n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2015-0845

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs