CVE-2015-9471: Unrestricted Upload of File with Dangerous Type

The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...

PT-2019-7430

Name of the Vulnerable Software and Affected Versions dzs-zoomsounds plugin versions through 2.0 for WordPress Description The issue concerns an arbitrary file upload in the admin/upload.php endpoint. This allows for potential malicious file uploads. Recommendations For versions through 2.0,...

CVE-2018-19421

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validatesafefile in admin/inc/securityfunctions.php...

CVE-2018-19421

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validatesafefile in admin/inc/securityfunctions.php...

CVE-2018-19421

CVE-2018-19421 affects GetSimpleCMS 3.3.15. The vulnerability arises in the upload handling: admin/upload-uploadify.php and the validation routine in admin/inc/security_functions.php interact with admin/upload.php, which blocks .html uploads but allows Internet Explorer to render HTML elements co...

PT-2018-14955

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.15 Description The issue concerns the upload functionality in GetSimpleCMS, where the admin/upload.php blocks uploads of .html files, but Internet Explorer can still render HTML elements in a .eml file. This is due to...

CVE-2018-19421: Unrestricted Upload of File with Dangerous Type

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validatesafefile in admin/inc/securityfunctions.php...

CVE-2018-19420: Unrestricted Upload of File with Dangerous Type

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g., the test or test.asdf filename, because of admin/upload-uploadify.php, and validatesafefile in...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6194

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6194: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

PT-2018-17399

Name of the Vulnerable Software and Affected Versions wp-splashing-images versions prior to 2.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the search parameter to "wp-admin/upload.php". Recommendations For versions prior to 2.1.1,...

CVE-2018-6195: Improperly Controlled Modification of Object Prototype Attributes

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2015-2195: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 paged, or 3 s parameter in the wp-media-cleaner page to wp-admin/upload.php...

PT-2015-5656

Name of the Vulnerable Software and Affected Versions WP Media Cleaner plugin version 2.2.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the view, paged, or s parameter in the "wp-media-cleaner" page to "wp-admin/upload.php". This can lead to cross-site...

CVE-2012-6621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Email Address or 2 Custom Permalink Structure fields in admin/settings.php; 3 path parameter to admin/upload.php; 4 err paramet...

PT-2014-2390

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1, 3.1.2, 3.2.3, and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields and parameters, including the Email Address and Custom Permalink Structure fields in...

Developed by vehement Upload Vulnerability

Exploit for php platform in category web applications ========================================== Developed by vehement Upload Vulnerability ========================================== Author : Emre5807 Homepage : http://www.1923turk.com Dork " Developed by www.vehement.in " Developed by...

CVE-2008-2988: Improper Input Validation

Unrestricted file upload vulnerability in admin/upload.php in Benja CMS 0.1 allows remote attackers to upload and execute arbitrary PHP files via unspecified vectors, followed by a direct request to the file in billeder/...

CVE-2008-2833: Improper Authentication

admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 parameter in conjunction with filenames in the filename and upload parameters...