CVE-2011-2933: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions...

CVE-2019-19595: Unrestricted Upload of File with Dangerous Type

reset/modules/advancedformmakeredit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file...

CVE-2014-1214: Unrestricted Upload of File with Dangerous Type

views/upload.php in the ProJoom Smart Flash Header NovaSFH component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted 1 dest parameter and 2 arbitrary extension in the Filename parameter...

CVE-2015-9471

CVE-2015-9471 affects the WordPress plugin dzs-zoomsounds (2.0), where an admin/upload.php arbitrary file upload vulnerability exists. The issue is tied to the dzs-zoomsounds WordPress plugin and results in potential unauthorized file uploads via its admin interface. The initial description state...

CVE-2015-9471: Unrestricted Upload of File with Dangerous Type

The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...

CVE-2016-10995

The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...

Default credentials

The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...

Design/Logic Flaw

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14706: Improper Restriction of Operations within the Bounds of a Memory Buffer

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14315

The CVE-2019-14315 entry documents a cross-site scripting (XSS) vulnerability in SunHater KCFinder where upload.php is affected in versions 3.20-test1, 3.20-test2, 3.12 and earlier. The root cause involves improper handling of input that allows an attacker to inject arbitrary web script or HTML v...

CVE-2019-14315: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter...

CVE-2019-12170: Unrestricted Upload of File with Dangerous Type

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/core/backups/upload.php aka backup component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...

CVE-2019-10869: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress when the Uploads add-on is activated. This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php aka upload/submit page name and...

CVE-2019-11615: Unrestricted Upload of File with Dangerous Type

/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server...

CVE-2019-11446: Unrestricted Upload of File with Dangerous Type

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase a...

CVE-2018-20526

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php...

CVE-2018-20526

The Roxy Fileman open-source file browser version 1.4.5 is vulnerable to unrestricted file upload via the upload.php file. An attacker can exploit this flaw to upload shell code or other malicious files to the server without authentication. Successful exploitation may lead to remote code executio...

CVE-2018-20526: Unrestricted Upload of File with Dangerous Type

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php...

Ultimate Membership Pro <= 7.5 - Arbitrary media upload

The ajax-upload.php endpoint doesn't check for the current user's capabilities or that they are even logged in, so we can do a few things we shouldn't be able to do: Without any credentials, you can simply POST the image file in the field ihcfile and it'll store it for you: $ curl -F...

CVE-2018-19463: Improper Control of Generation of Code

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...