Unrestricted file upload

Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-6769: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2009-1446: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details ar...

CVE-2008-6617: Undefined Security Weakness

Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/...

CVE-2009-1090

Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter...

CVE-2009-1089

CVE-2009-1089 describes an absolute path traversal in Rapidleech (rev.36 and earlier) where a base64-encoded absolute path supplied in the filename parameter to upload.php allows remote attackers to read arbitrary files. The CVE is documented with a Medium (5.0) severity per NVD; however, the pro...

CVE-2009-1091

CVE-2009-1091 : Cross-site scripting (XSS) vulnerability in upload.php of Rapidleech rev.36 and earlier. Remote attackers can inject arbitrary web script or HTML via the uploaded parameter. Affected: Rapidleech upload.php (rev.36 and earlier). Impact: partial integrity; no confidentiality or avai...

CVE-2009-1089: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a base64-encoded absolute path in the filename parameter...

CVE-2009-1090: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter...

CVE-2009-1091: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web script or HTML via the uploaded parameter...

CVE-2009-0602: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/...

CVE-2008-6118: Improper Authentication

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1...

WikkiTikkiTavi 'upload.php'任意文件上传漏洞

BUGTRAQ ID: 33647 CNCAN ID：CNCAN-2009020702 WikkiTikkiTavi是一款Wiki引擎。 WikkiTikkiTavi 'upload.php'脚本存在漏洞，远程攻击者可以利用漏洞上传任意PHP文件。 攻击者通过上传恶意PHP文件，可导致以WEB权限执行任意命令。 WikkiTikkiTavi 1.11 厂商解决方案 目前供应商没有提供补丁信息： http://tavi.sourceforge.net/...

Directory traversal

Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager pPIM 1.0 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter within a delfile action...

CVE-2008-4428

CVE-2008-4428 affects Phlatline’s Personal Information Manager (pPIM) 1.0 and earlier. Unrestricted file upload in upload.php allows remote attackers to upload a .php file and execute it by requesting the file in the top‑level directory, enabling remote code execution (CVSSv2 base score 10.0, HIG...

CVE-2008-4425

Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager pPIM 1.0 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter within a delfile action...

CVE-2008-4425: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager pPIM 1.0 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter within a delfile action...

CVE-2008-4428: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager pPIM 1.0 and earlier allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in the top-level directory...

Unfixed XSS vulnerability at www.emascc.net

Security researcher pSyChOmOnkee, has submitted on 17/09/2008 a cross-site-scripting XSS vulnerability affecting www.emascc.net, which at the time of submission ranked 14736305 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/10/2008. It is...

Ppim <= 1.0 (Arbitrary File Delete/XSS) Multiple Vulnerabilities

No description provided by source. Author : BeyazKurt Contact : [email protected] Script : Ppim v1.0 Bu ne bicim script adidir amk :D Download : http://scripts.ringsworld.com/organizers/ppim.zip D0rk : inurl:events.php?listallevents File Delete Vulnerability: upload.php...