20 matches found
CVE-2024-51568---CyberPanel-Command-Injection-Nuclei-Template
CVE-2024-51568 - CyberPanel 명령 삽입 PoC CVE-2024-51568을 테스트하기 위한 개념 증명 환경 및 Nuclei 템플릿입니다. 이는 CyberPanel의 중요한 사전 인증 명령 삽입 취약점입니다. 취약점 세부 정보 CVE: CVE-2024-51568 심각도: 중요 CVSS 9.8 유형: 사전 인증 명령 삽입 엔드포인트: /filemanager/upload 파라미터: completePath 영향: 루트 권한으로 원격 코드 실행 빠른 시작 1. 취약한 환경 시작 cd docker/...
CVE-2026-100520
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...
CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...
CVE-2026-100520
Laranode versions before 1.2.1 are vulnerable to a path traversal vulnerability within the POST /filemanager/upload-file endpoint. This flaw allows authenticated users to bypass directory restrictions by supplying traversal sequences in the path parameter. Consequently, an attacker can write arbi...
CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...
EUVD-2026-87375
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...
PT-2026-99146
Name of the Vulnerable Software and Affected Versions Laranode versions prior to 1.2.1 Description Authenticated users can exploit a path traversal flaw to write arbitrary files outside their designated home directory. By providing directory traversal sequences in the path parameter of the 'POST...
CVE-2026-100520: Improper Limitation of a Pathname to a Restricted Directory
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...
CVE-2021-47965
WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote co...
PT-2026-41344
Name of the Vulnerable Software and Affected Versions WP Super Edit versions 2.5.4 and earlier Description The FCKeditor component contains an unrestricted file upload flaw. Attackers can upload arbitrary and dangerous file types without validation through the 'filemanager upload' endpoint, which...
CVE-2024-58279
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by...
CVE-2024-58279
CVE-2024-58279 affects appRain CMF 4.0.5. An authenticated administrator can upload a crafted PHP file via the filemanager/upload endpoint, leading to remote code execution and the potential formation of a web shell with command execution in the uploads directory. Multiple connected sources corro...
CVE-2024-58279 appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by...
CVE-2024-58279: Unrestricted Upload of File with Dangerous Type
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by...
EUVD-2018-10578
Malware in sbrugna...
CVE-2016-15042
The Frontend File Manager versions 4.0, N-Media Post Front-end Form versions 1.1 plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nmfilemanageruploadfile and nmpostfrontuploadfile AJAX actions. This makes it possible for unauthenticated...
CVE-2017-20063
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgradi...
CVE-2017-20063: Improper Privilege Management
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgradi...
CVE-2018-16974: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...