PT-2023-11532

Name of the Vulnerable Software and Affected Versions KOHGYLW Kiftd version 1.0.18 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the iframe tag in the upload file page. Recommendations For version 1.0.18, consider disabling the upload file page...

PT-2023-12158

Name of the Vulnerable Software and Affected Versions KiteCMS affected versions not specified Description A permissions issue in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. This enables unauthorized access and potential code execution. Recommendations At t...

CVE-2020-19699: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the tag in the upload file page...

CVE-2021-31707

CVE-2021-31707 affects KiteCMS. A permissions issue in the upload file type allows a remote attacker to execute arbitrary code. The vulnerability is characterized by a high-severity CVSS v3.1 score (9.8, CRITICAL) with network access, no privileges required, and no user interaction needed, and it...

CVE-2023-0340

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2023-0340 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2021-32302

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

Cross site scripting

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

CVE-2021-32302

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

CVE-2021-32302

CVE-2021-32302 affects IRZ Electronics RUH2 GSM router. The vulnerability is a Cross Site Scripting (XSS) flaw in the router’s vulnerability surface exposed via the Upload File parameter , enabling an attacker to obtain sensitive information. Root cause and details are corroborated by multiple so...

CVE-2021-32302: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter...

iRZ Mobile Routers 跨站脚本漏洞

iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in iRZ Mobile Routers. An attacker could use this vulnerability to obtain sensitive information via the Upload File parameter...

Remote Code Execution (RCE)

openmage/magento-lts is vulnerable to Remote Code Execution RCE. The vulnerability exists due to insufficient input validation which allows an administrator with upload file permission to create products which results in arbitrary code execution via the convert profile...

WordPress Upload File Type Settings Plugin Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Upload File Type Settings Plugin Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25781 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1b1468ec7ed1 Credits Rio Darmaw...

CVE-2023-22629

An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem...

CVE-2023-0080

The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their...

Pimcore contains Unrestricted Upload of File with Dangerous Type

Impact The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature p.e. GIF89 and sending any invalid content-type. This could allow an authenticated attacker to uplo...

CVE-2022-40035

File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via the /uploadFileList component...

PT-2023-13743 · Unknown · Rawchen Blog-Ssm

Name of the Vulnerable Software and Affected Versions: Rawchen Blog-ssm version 1.0 Description: A file upload issue allows attackers to execute arbitrary commands and gain escalated privileges via the "uploadFileList" component, specifically through the "/uploadFileList" API endpoint...

PT-2023-12626 · WordPress · Club-Theme +9

Name of the Vulnerable Software and Affected Versions: WeStand WordPress theme versions prior to 2.1 footysquare WordPress theme aidreform WordPress theme statfort WordPress theme club-theme WordPress theme kingclub-theme WordPress theme spikes WordPress theme spikes-black WordPress theme...