CVE-2019-6127

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename.

• CWE-89

• https://github.com/Eas3n/Vulnerabilities/blob/master/XiaoCMS_20141229_GETSHELL.mdExploit, Third Party Advisory
• https://github.com/Eas3n/Vulnerabilities/blob/master/XiaoCMS_20141229_GETSHELL.mdExploit, Third Party Advisory

Published

Jan 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6116In Artifex Ghostscript through 9.26, ephemeral or transient …7.8
• CVE-2019-6117The wpape APE GALLERY plugin 1.6.14 for WordPress has stored…
• CVE-2019-6120An issue was discovered in NiceHash Miner before 2.0.3.0. A …7.5
• CVE-2019-6121An issue was discovered in NiceHash Miner before 2.0.3.0. Mi…3.7
• CVE-2019-6122A Username Enumeration via Error Message issue was discovere…3.1
• CVE-2019-6126The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM…
• CVE-2019-6128The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has …8.8
• CVE-2019-6129png_create_info_struct in png.c in libpng 1.6.36 has a memor…6.5
• CVE-2019-6130Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page…
• CVE-2019-6131svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion wit…
• CVE-2019-6132An issue was discovered in Bento4 v1.5.1-627. There is a mem…
• CVE-2019-6133In PolicyKit (aka polkit) 0.115, the "start time" protection…