Priority MEDIUM 44
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00262 · Published 2026-10-22 · Fixed in 5.4.081 CWE-89
Priority HIGH 72
phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01018 · Published 2024-09-10 · No fix listed CWE-22
Priority LOW 27
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2024-07-01 · No fix listed CWE-79
Priority HIGH 68
phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00415 · Published 2024-05-09 · No fix listed CWE-89
Priority HIGH 72
SQL injection vulnerability in PHPOK v.5.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00869 · Published 2023-06-20 · No fix listed CWE-89
Priority HIGH 73
An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00945 · Published 2023-06-07 · No fix listed CWE-434
Priority HIGH 71
A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00694 · Published 2023-05-25 · No fix listed CWE-434
Priority MEDIUM 51
PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01192 · Published 2023-05-11 · No fix listed CWE-94
Priority HIGH 73
File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00865 · Published 2023-05-11 · No fix listed CWE-434
Priority HIGH 82
Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01247 · Published 2022-10-18 · No fix listed CWE-502
Priority MEDIUM 45
Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01315 · Published 2022-05-12 · No fix listed CWE-502
Priority MEDIUM 45
Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01659 · Published 2021-11-02 · No fix listed CWE-120
Priority MEDIUM 41
An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01007 · Published 2021-11-02 · No fix listed
Priority LOW 36
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0166 · Published 2021-11-02 · No fix listed CWE-22
Priority MEDIUM 40
A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrary code.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00913 · Published 2021-05-10 · No fix listed CWE-352
Priority MEDIUM 45
PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01458 · Published 2021-02-08 · No fix listed CWE-89
Priority MEDIUM 47
framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.06522 · Published 2019-09-09 · No fix listed CWE-434
Priority LOW 38
An issue was discovered in OKLite v1.2.25.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.06123 · Published 2019-09-09 · No fix listed CWE-22
Priority LOW 28
An issue was discovered in PHPok v5.0.055.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00614 · Published 2018-12-10 · No fix listed CWE-79
Priority MEDIUM 42
An issue was discovered in PHPok 4.9.015.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02214 · Published 2018-11-26 · No fix listed CWE-434
Priority LOW 28
PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00692 · Published 2018-08-30 · No fix listed CWE-79
Priority LOW 35
PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00912 · Published 2018-06-15 · No fix listed CWE-20
Priority MEDIUM 45
PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-89…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0163 · Published 2018-06-15 · No fix listed CWE-434
Priority MEDIUM 44
PHPOK 4.8.338 has an arbitrary file upload vulnerability.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01164 · Published 2018-03-22 · No fix listed CWE-434
THREATIST.IORead the docs