CVE-2026-63147

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $FIL...

CVE-2026-63148 Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $FILES. Attackers ca...

CVE-2026-63147

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $FIL...

CVE-2026-63147 Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $FIL...

CVE-2026-63147 Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $FIL...

CVE-2026-63147

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an insufficient filter for file names received via the **esult{_FILES}** superglobal, which allows attackers to bypass the existing paramFilter used foresult{_GET} andes...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2024-37869

The CVE-2024-37869 entry describes a file upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0. A remote attacker can trigger arbitrary code execution via the poster.php handler, with the uploaded payload received through the $_FILES variable. The available references indica...

Sql injection

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17731

DedeCMS versions through 5.7 are vulnerable to SQL Injection due to improper neutralization of special elements in the $_FILES superglobal, specifically affecting the plus/recommend.php component. A remote attacker can exploit this flaw to execute arbitrary SQL commands, potentially resulting in ...

CVE-2017-17731: Improper Neutralization of Special Elements used in an SQL Command

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

PHP 5.4.x < 5.4.1 Multiple Vulnerabilities

Binary data 6994.prm...

CVE-2012-1172

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid open square bracket characters in name values, which makes it easier for remote attackers to cause a denial of service malformed $FILES indexes or conduct directory traversal attacks during multi-file...

PHP < 5.3.11 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is earlier than 5.3.11, and as such is potentially affected by multiple vulnerabilities : - During the import of environment variables, temporary changes to the 'magicquotesgpc' directive are not handled properly. This can...

PHP 5.4.x < 5.4.1 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.1, and, therefore, potentially affected by multiple vulnerabilities : - The '$FILES' variable can be corrupted because the names of uploaded files are not properly validated. CVE-2012-1172 - The...

Mandriva Linux Security Advisory : php (MDVSA-2012:065)

Multiple vulnerabilities has been identified and fixed in php : The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service application crash via a crafted application that uses a PDO driver for a...

CVE-2007-4369: Undefined Security Weakness

Directory traversal vulnerability in go/files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2004-0959: Undefined Security Weakness

rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$FILES" array to be modified...