CVE-2019-9651

An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions (such as "eval") are blocked but others (such as "system") are not, and because ".php" is blocked but ".PHP" is not blocked.

• CWE-94

• http://www.iwantacve.cn/index.php/archives/155/Exploit, Third Party Advisory
• http://www.iwantacve.cn/index.php/archives/155/Exploit, Third Party Advisory

Published

Mar 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9644An XSSI (cross-site inclusion) vulnerability in Jupyter Note…
• CVE-2019-9646The Contact Form Email plugin before 1.2.66 for WordPress al…
• CVE-2019-9647Gila CMS 1.9.1 has XSS.
• CVE-2019-9648An issue was discovered in the SFTP Server component in Core…
• CVE-2019-9649An issue was discovered in the SFTP Server component in Core…
• CVE-2019-9650An XSS issue was discovered in upcoming_events.php in the Up…
• CVE-2019-9652There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit …
• CVE-2019-9653NUUO Network Video Recorder Firmware 1.7.x through 3.3.x all…
• CVE-2019-9656An issue was discovered in LibOFX 0.9.14. There is a NULL po…8.8
• CVE-2019-9657Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Co…
• CVE-2019-9658Checkstyle before 8.18 loads external DTDs by default.
• CVE-2019-9659The Chuango 433 MHz burglar-alarm product line uses static c…