All CVEs — page 374 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to access sensitive debug and Gii modules, exposing session cookies and database queries, and potentially writing PHP files to the application directory.
The flaw allows authenticated managers to upload PHP files, enabling arbitrary code execution on the server.
The flaw allows command injection by improperly escaping shell arguments, enabling attackers to execute arbitrary commands with Deno process privileges.
The restbed framework is vulnerable to a memory exhaustion attack through WebSocket frames with extremely large payload lengths, allowing unauthenticated remote attackers to cause denial of service by consuming all available server memory.
The restbed library fails to enforce maximum size limits on HTTP request headers, allowing attackers to stream unlimited data without sending header delimiters, leading to unbounded heap memory allocation and potential server memory exhaustion.
This flaw allows for PHP object injection, enabling attackers to execute arbitrary code on the server. It matters because it can lead to full server compromise.
This flaw allows for PHP object injection in Contributor PHP Object Injection in Nested Pages versions up to 3.3.2, enabling attackers to execute arbitrary code with the privileges of the web server.
The flaw allows an authenticated user to make the backend server send HTTP requests to arbitrary URLs, posing a risk of sensitive data exposure and server compromise.
The flaw allows unauthenticated access to Docker management APIs due to an empty AGENT_SECRET configuration, enabling unauthorized control over Docker containers.