CVE-2020-5512

CVE-2020-5512 concerns Gila CMS 1.11.8, where the path parameter in the admin media interface (media-assets.php) is mishandled, enabling a path traversal to access files outside restricted directories. Multiple connected records corroborate this: CNVD-2020-03268 and PRlON/ CPAI-2020-0294 describe...

CVE-2020-5512: Improper Limitation of a Pathname to a Restricted Directory

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...

PT-2020-18489

Name of the Vulnerable Software and Affected Versions Gila CMS version 1.11.8 Description The issue allows for path traversal via the /admin/media endpoint. Specifically, the "path" parameter in the /admin/media?path=../ endpoint is vulnerable, allowing an attacker to traverse the directory...

WBCE CMS File Rename Filter Bypass Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in the admin/media/rename.php file in WBCE CMS 1.4.0 and earlier versions. An attacker can exploit the vulnerability to rename media file names and extensions to execute arbitrary PHP...

CVE-2019-17575

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...

CVE-2019-17575: Use of Incorrectly-Resolved Name or Reference

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. For example: place PHP code in a .jpg file, and then change the file's base name to filename.p...

PT-2019-15208

Name of the Vulnerable Software and Affected Versions WBCE CMS versions 1.4.0 and earlier Description A file-rename filter bypass issue exists in the admin/media/rename.php file. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension,...

CVE-2019-17536

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/mediaupload and fm/move...

PT-2019-15194

Name of the Vulnerable Software and Affected Versions Gila CMS versions prior to 1.11.5 Description The issue allows an attacker to upload a file with a dangerous type via the moveAction function in core/controllers/fm.php. This can be achieved by using the admin/media upload and fm/move endpoint...

PT-2019-14924

Name of the Vulnerable Software and Affected Versions Ilch version 2.1.22 Description The issue allows remote code execution. This is because php is listed under "Allowed files" on the /admin/media/settings/index page, which can be exploited. Recommendations For Ilch version 2.1.22, remove php fr...

CVE-2019-17046: Unrestricted Upload of File with Dangerous Type

Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...

CVE-2018-12988

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

Dotclear cross-site scripting vulnerability (CNVD-2017-00084)

Dotclear is a software developer OlivierMeunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/media.php and admin/mediaitem.ph files in versions of Dotclear prior to 2.11. A remote attacker can inject arbitrary web...

UBUNTU-CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

PT-2016-7864

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.11 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media title parameter in admin/media.php and admin/media item.php...

CVE-2012-6634

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

CVE-2012-6634: Undefined Security Weakness

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

PT-2014-2403

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.3 Description The issue allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions. This is achieved by manipulating the post id value in the wp-admin/media-upload.p...

Information disclosure

Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap CVE-2005-2436...

CVE-2011-3817: Exposure of Sensitive Information to an Unauthorized Actor

Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap CVE-2005-2436...