461 matches found
CVE-2018-14334: Unrestricted Upload of File with Dangerous Type
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766...
CVE-2018-11523
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files...
CVE-2018-11523
CVE-2018-11523 : The NUUO NVRmini 2 series (NUUO NVRmini 2, NVRsolo) is affected by a vulnerability in upload.php that enables arbitrary file upload. The issue arises from an upload mechanism that allows uploading files such as PHP scripts, enabling potential remote code execution on affected dev...
NUUO NVRmini 2 Arbitrary File Upload Vulnerability
The NUUO NVRmini 2 is a video storage management device from NUUO USA. A security vulnerability exists in the upload.php file in the NUUO NVRmini 2. An attacker can exploit this vulnerability to upload arbitrary files e.g., .php files...
CVE-2018-11523: Unrestricted Upload of File with Dangerous Type
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files...
Design/Logic Flaw
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-8766: Unrestricted Upload of File with Dangerous Type
joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/adminvod.php?action=add...
CVE-2018-6943
The CVE-2018-6943 entry concerns the WordPress UltimateMember plugin (v2.0) where core/lib/upload/um-image-upload.php is vulnerable to cross-site scripting due to improper sanitization of input assigned to the $temp variable. This XSS condition is documented across multiple sources (NVD listing a...
CVE-2018-6944
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6943
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6944: Improper Neutralization of Input During Web Page Generation
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6943: Improper Neutralization of Input During Web Page Generation
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
CVE-2018-6846
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
Path traversal
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-6846: Exposure of Sensitive Information to an Unauthorized Actor
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-6194: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...
CVE-2018-6195: Improperly Controlled Modification of Object Prototype Attributes
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...