CVE-2024-9816 Codezips Tourist Management System change-image.php unrestricted upload

A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely...

CVE-2024-9816 Codezips Tourist Management System change-image.php unrestricted upload

A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely...

CVE-2024-9816: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely...

PT-2024-39861

Name of the Vulnerable Software and Affected Versions Codezips Tourist Management System version 1.0 Description A critical issue affects some unknown functionality of the file /admin/change-image.php, where the manipulation of the packageimage argument leads to unrestricted upload. The attack ca...

PT-2024-38991

Name of the Vulnerable Software and Affected Versions: ABCD ABCD2 versions 2.2.0-beta-1 and earlier Description: A problematic issue has been found in ABCD ABCD2, affecting an unknown part of the file /common/show image.php. The manipulation of the image argument leads to path traversal, allowing...

PT-2024-11513

Name of the Vulnerable Software and Affected Versions Skitter Slideshow plugin for WordPress versions up to, and including, 2.5.2 Description The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the "image.php" file. This...

CVE-2022-1751: Server-Side Request Forgery (SSRF)

The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and ca...

PT-2024-24473

Name of the Vulnerable Software and Affected Versions Phpgurukul Tourism Management System version 2.0 Description The issue allows for Unrestricted Upload of File with Dangerous Type via the "/tms/admin/change-image.php" API endpoint. When updating a current package, there are no checks for what...

CVE-2024-32256: Unrestricted Upload of File with Dangerous Type

Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image...

PT-2024-24478

Name of the Vulnerable Software and Affected Versions Panwei eoffice OA versions up to 9.5 Description A critical issue affects the Backend component of the software, specifically the file /general/system/interface/theme set/save image.php. The manipulation of the image type argument leads to pat...

CVE-2024-3129: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument imagename leads to unrestricted upload. It is possible to initiate the attack remotel...

CVE-2018-25094 ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal

A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to...

CVE-2018-25094: Path Traversal: '../filedir'

A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to...

Adult Video Script 8.2 File Inclusion

==================================================================================================================================== | Title : Adult Video Script 8.2 RFI /LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

PT-2022-16540

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description An issue in the "/admin/delete image.php" endpoint of eliteCMS allows attackers to delete arbitrary files. Recommendations For eliteCMS version 1.0, consider restricting access to the "/admin/delete image.php"...

CVE-2021-42362: Unrestricted Upload of File with Dangerous Type

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain...

Joomla! com_fabrik 3.9.11 - Directory Traversal

Joomla! comfabrik 3.9.11 - Directory Traversal Exploit Title: Joomla! comfabrik 3.9.11 - Directory Traversal Google Dork: inurl:"index.php?option=comfabrik" Date: 2020-03-30 Exploit Author: qw3rTyTy Vendor Homepage: https://fabrikar.com/ Software Link: https://fabrikar.com/downloads Version: 3.9...

CVE-2013-2631

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

Path traversal

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...

CVE-2013-2631

TinyWebGallery TWG 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twgbrowserx" and "twgbrowsery" in the page image.php...