CVE-2022-24868: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user...

PT-2022-7407 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.0 Description: The issue is related to a lack of sanitization on SVG file uploads, allowing an attacker to inject javascript into a user's avatar. This can lead to a cross-site scripting attack when any user views...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

WordPress E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The WordPress VikBooking Hotel Booking Engine & PMS plugin is vulnerable to arbitrary file uploads due to...

Elcomplus SmartPPT 代码问题漏洞

Elcomplus SmartPPT is an integrated voice and data scheduling software from Elcomplus USA. A code issue vulnerability exists in Elcomplus SmartPPT that stems from a lack of restriction on the size or number of files that can be uploaded. An attacker could exploit this vulnerability to upload or...

CVE-2022-1091

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending...

WSO2 API Manager 路径遍历漏洞

WSO2 API Manager is an API lifecycle management solution from US-based WSO2. WSO2 API Manager suffers from a path traversal vulnerability that allows unlimited file uploads and remote code execution...

CVE-2022-27261

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server...

CVE-2022-28033

Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminuploads.php...

CVE-2022-28033

Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminuploads.php...

CVE-2022-28033

Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminuploads.php...

PT-2022-18244 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost version 4.39.0 Description: The issue concerns an arbitrary file upload vulnerability in the file upload module, potentially allowing attackers to execute arbitrary code via a crafted SVG file. However, the vendor states that uploading...

Atom.CMS SQL注入漏洞

CMS is a content management system from The Digital Craft individual developers in the U.S. A SQL injection vulnerability exists in Atom.CMS version 2.0, which stems from a lack of validation of external input SQL statements in Atom.CMSadminuploads.php, which could be exploited to execute illegal...

PT-2022-18338 · Unknown · Express-Fileupload

Name of the Vulnerable Software and Affected Versions: Express-FileUpload version 1.3.1 Description: The issue allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This can be exploited due to an arbitrary file write...

PT-2022-16912

Name of the Vulnerable Software and Affected Versions HedgeDoc versions 1.9.1 through 1.9.2 Description HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc have an enumerable filename after the upload, resulting in potential information...

MoguBlog 代码问题漏洞

MoguBlog MoguBlog is a front-end and back-end separated blogging system based on microservice architecture by an individual developer in Streamlet, China. A security vulnerability exists in MoguBlog version 5.2, which stems from uploading files without any restrictions...

PHPGURUKUL Zoo Management System 代码问题漏洞

PHPGURUKUL Zoo Management System is a zoo management system by the PHPGurukul Phpgurukul team. A security vulnerability exists in Zoo Management System v1.0, which stems from the lack of a restriction on the type of file that can be uploaded in /publichtml/applyvacancy, which can be exploited by ...

Simple House Rental System 代码问题漏洞

House Rental System is a house rental management system that allows you to add, modify and delete property information, and to place bookings. A security vulnerability exists in Simple House Rental System v1.0, which stems from the lack of restrictions on the type of files that can be uploaded in...

CVE-2021-43430

An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via imwebserver, which could let a malicious user upload PHP Trojan files...

Denial Of Service (DoS)

mediawiki is vulnerable to denial of service DoS attacks. NewFiles on a wiki with many file uploads with actor as a condition leads to denial of service conditions...