Egix

تسمح هذه الثغرة للمستخدمين غير المصادق عليهم باستدعاء طرق محمية من وحدات التحكم في واجهة برمجة التطبيقات (API) عند تشغيلها على PHP 8.1 أو إصدارات أحدث، كما يتضح من النمط ”/api.php?method=protectedMethod“. وقد تم استغلال هذه الثغرة في الواقع في مايو 2025. تشير التقديرات إلى أن أكثر من 42,500 خدمة قد تكون متأثرة. تنشأ هذه الثغرة الأمنية عن الاستخدام غير الصحيح لـ ReflectionMethod::invoke() من قِبل vBulletin، حيث لم يعد هذا الاستخدام في PHP 8.1+ يحظر الوصول إلى الطرق المحمية بشكل افتراضي. يمكن للمهاجمين تشغيل وظائف داخلية حساسة عن بُعد كانت مخصصة في الأصل لتكون غير قابلة للوصول، والحصول على تنفيذ التعليمات البرمجية على الخادم.

تسمح هذه الثغرة للمهاجمين بتنفيذ تعليمات برمجية PHP تعسفية من خلال استغلال «شروط القوالب» في آلية القوالب. يمكن للمهاجمين صياغة كود القوالب باستخدام صيغة بديلة لاستدعاء وظائف PHP، مثل صيغة ”var dump“(”test“)، للتحايل على إجراءات التحقق الأمنية وتنفيذ كود PHP تعسفي. تم استغلال هذه الثغرة بشكل نشط في مايو 2025.

The issue allows code injection.

The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application.

The issue is related to a type confusion in the autologin.php file within the plugins/preloads directory, leading to an Authentication Bypass. This occurs due to the use of the != operator instead of the !== operator.

The issue allows directory traversal via the `image temp` parameter in the `libraries/image-editor/image-edit.php` file. This can potentially lead to unauthorized access to sensitive files on the server.

The issue allows for SQL Injection in the include/findusers.php groups. There is a remote code execution exploit.

The issue is related to Incorrect Access Control in ImpressCMS, specifically in the include/findusers.php file, which allows access by unauthenticated attackers who have a security token by design.

The issue is related to the `IPScmsmodulesfrontpages builder::previewBlock` method interacting unsafely with the `IPS Theme::runProcessFunction` method, allowing for eval-based PHP code injection by a moderator. This is due to incorrect code generation management in the IPS Community Suite software. Exploitation of the issue may allow a remote attacker to execute arbitrary PHP code.

Name of the Vulnerable Software and Affected Versions: ExpressionEngine versions prior to 5.4.2 ExpressionEngine versions 6.x prior to 6.0.3 Description: The issue allows PHP code injection by certain authenticated users who can leverage `Translate::save()` to write to an lang.php file under the system/user/language directory. This can be exploited by authenticated users. Recommendations: For ExpressionEngine versions prior to 5.4.2, update to version 5.4.2 or later. For ExpressionEngine versions 6.x prior to 6.0.3, update to version 6.0.3 or later. As a temporary workaround, consider restricting access to the `Translate::save()` function until a patch is available.

The issue is related to the deserialization of untrusted data in the Concrete5 CMS system. The vulnerable code is located within the `controllers/single page/dashboard/system/environment/logging.php` file, specifically in the `Logging::update logging()` method. User input passed through the `logFile` request parameter is not properly sanitized before being used in a call to the `file exists()` PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope, allowing them to carry out various attacks, such as executing arbitrary PHP code.

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions 5.4.0 and earlier Description: The issue allows remote attackers to view files and execute local script code due to local file-include vulnerabilities in the `customerportal.php` file. Recommendations: For versions 5.4.0 and earlier, consider restricting access to the `customerportal.php` file until a fix is available. As a temporary workaround, restrict the execution of local script code in the `customerportal.php` file to minimize the risk of exploitation.

The issue allows remote attackers to execute arbitrary code via the `form single user login` parameter in the install/index.php file.

The issue allows remote attackers to execute arbitrary PHP code due to the use of `unserialize()` with user-controlled input in certain scripts.

The issue exists due to the User::getRecentElements() method using the unserialize() function with a preference value that can be manipulated by malicious users through the REST API interface. This allows an attacker to inject arbitrary PHP objects into the application scope, enabling various attacks, including Remote Code Execution.

The issue is related to a SQL injection vulnerability.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control of user sessions.

The issue is related to a PHP Object Injection Vulnerability in the PHP Serializer, which allows remote code execution. The root cause is attributed to an incorrect regular expression.

The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the `catlist[]` parameter to "engine/preview.php". The vulnerability is exploited through a `preg replace` function call with an `e` modifier.

The issue allows remote authenticated users to conduct PHP object injection attacks, potentially causing a denial of service. This is due to improper handling of an object obtained by unserializing a cookie in the `plugins/system/remember/remember.php` file.